Graylog Extractor - Sidecar Multiline

[gsmith]

Hello,

Maybe something here might be able to help you.

Difficult to match multiline log file with multiple patterns

As far as I can tell filebeat doesn’t support multiple multiline.pattern, multiline.negate, and multiline.match entries for the same log. Am I missing something? I know I can do an “OR” pattern in the multiline.pattern entry, but that doesn’t help me because I can only have a single negate and/or match entry. Is there any method that supports grouping multiline entries based on a common unique ID (like a Thread ID/PID/etc) that gets printed on all the lines in the multiline entry? IE, I’d like…

Hope that helps.