GROK Pattern to Match New Line

Graylog Central (peer support)
1

My log files occasionally have multi-line messages in them, I have filebeat configured to bring them in without issue but I cannot for the life of me get a GROK pattern to accept the new line characters. In my most common case the log entry includes a SQL statement which, depending on how it was created may have newline characters.

When it’s all one line it’s fine as .* matches, what syntax can I use in a graylog regex/grok to accept carriage return / new line characters? I have tried most of the variations I can find online with no luck.

2
3

Thanks Jochen, as an aside do you think it’d be feasible to replace the new line characters with a pipeline rule or do they work in the same manner?

Original Quoted context has been removed as per policy

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.