'question on multiline.pattern different examples
new to filebeat and multiline.pattern configuration as a whole.
I was reading up on multiline.pattern examples and came across this multiline.pattern examples. where the example used was multiline.pattern: '^[[space]]'. But lets say if each line after the initial line beginning was a symbol like { or " instead of a whitespace, how do I put it?
multiline.pattern: '^{' or multiline.pattern: '^[[{]]' or something else entirely?
If I want to combine both options will it be multiline.pattern: '^{|^"' instead?
Sorry if it sounds like a dumb and simple question but I am not able to find any relevant/similar queries like this.
Solution 1:[1]
This is just a usual regex pattern.
If you have set the:
multiline.negate: false
multiline.match: after
It matches any line against the pattern and appends it to the previous line if match passes.
For your query that if the pattern start with " or { or space, the pattern would be:
^[[:space:]]|\{|[[:space:]]\"
You can refer https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html to get the more detailed examples.
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|---|
| Solution 1 | lprakashv |