Why is multiline not working for this unstructured log?

Elastic Stack Beats
1

My multiline:

parsers:
 -multiline:
      type: pattern
      pattern: '^\{'
      negate: true
      match: after

The format of my log can be like this:

{ C-FLOW-ID-CAB APN101MQ C-OPERATION-CAB P T-EVENTO-CAB RUNNING T-EXTERNAL-ID-CAB NULL F-MESSAGE-CAB 20221110 H-MESSAGE-CAB 600478 C-MESSAGE-ID-CAB DC62CCED0E5F6000 M-STATUS-CAB 02
}

and also:

{C-FLOW-ID-CAB APN101MQ C-OPERATION-CAB P T-EVENTO-CAB RUNNING T-EXTERNAL-ID-CAB NULL F-MESSAGE-CAB 20221110 H-MESSAGE-CAB 600478 C-MESSAGE-ID-CAB DC62CCED0E5F6000 M-STATUS-CAB 02 [
<FOTO><Status>RUNNING</Status><EVENTO>2022111006:00:47.3</EVENTO></FOTO>
]}

In the first example log that I put I get this (the closing of the bracket is not there):

FirstExample.png
FirstExample.png1351×105 22.7 KB

In the second example log that I put I get this:
SecondExample.png
SecondExample.png1358×107 35.7 KB

SecondExample2.png
SecondExample2.png737×82 17.1 KB

In this second example I get 2 errors, the first and most significant is that the log is separated into two parts and the other is the same as the closing bracket.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.