Why is multiline not working for this unstructured log?

My multiline:

parsers:
 -multiline:
      type: pattern
      pattern: '^\{'
      negate: true
      match: after   

The format of my log can be like this:

{ C-FLOW-ID-CAB APN101MQ C-OPERATION-CAB P T-EVENTO-CAB RUNNING T-EXTERNAL-ID-CAB NULL F-MESSAGE-CAB 20221110 H-MESSAGE-CAB 600478 C-MESSAGE-ID-CAB DC62CCED0E5F6000 M-STATUS-CAB 02
}

and also:

{C-FLOW-ID-CAB APN101MQ C-OPERATION-CAB P T-EVENTO-CAB RUNNING T-EXTERNAL-ID-CAB NULL F-MESSAGE-CAB 20221110 H-MESSAGE-CAB 600478 C-MESSAGE-ID-CAB DC62CCED0E5F6000 M-STATUS-CAB 02 [
<FOTO><Status>RUNNING</Status><EVENTO>2022111006:00:47.3</EVENTO></FOTO>
]}

In the first example log that I put I get this (the closing of the bracket is not there):


In the second example log that I put I get this:


In this second example I get 2 errors, the first and most significant is that the log is separated into two parts and the other is the same as the closing bracket.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.