My log files occasionally have multi-line messages in them, I have filebeat configured to bring them in without issue but I cannot for the life of me get a GROK pattern to accept the new line characters. In my most common case the log entry includes a SQL statement which, depending on how it was created may have newline characters.
When it’s all one line it’s fine as .* matches, what syntax can I use in a graylog regex/grok to accept carriage return / new line characters? I have tried most of the variations I can find online with no luck.