question on multiline.pattern different examples

user_18618652 0
Viewed 158

new to filebeat and multiline.pattern configuration as a whole.

I was reading up on multiline.pattern examples and came across this multiline.pattern examples. where the example used was multiline.pattern: '^[[space]]'. But lets say if each line after the initial line beginning was a symbol like { or " instead of a whitespace, how do I put it?

multiline.pattern: '^{' or multiline.pattern: '^[[{]]' or something else entirely?

If I want to combine both options will it be multiline.pattern: '^{|^"' instead?

Sorry if it sounds like a dumb and simple question but I am not able to find any relevant/similar queries like this.

filebeat multiline
1 Answers

This is just a usual regex pattern.

If you have set the:

multiline.negate: false
multiline.match: after

It matches any line against the pattern and appends it to the previous line if match passes.

For your query that if the pattern start with " or { or space, the pattern would be:

^[[:space:]]|\{|[[:space:]]\"

You can refer https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html to get the more detailed examples.

user_40668020
Related