GROK Pattern to Match New Line

My log files occasionally have multi-line messages in them, I have filebeat configured to bring them in without issue but I cannot for the life of me get a GROK pattern to accept the new line characters. In my most common case the log entry includes a SQL statement which, depending on how it was created may have newline characters.

When it’s all one line it’s fine as .* matches, what syntax can I use in a graylog regex/grok to accept carriage return / new line characters? I have tried most of the variations I can find online with no luck.

Thanks Jochen, as an aside do you think it’d be feasible to replace the new line characters with a pipeline rule or do they work in the same manner?

Original Quoted context has been removed as per policy

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.