How do I match a newline in grok/logstash?
Adding the regex flag to the beginning allows for matching newlines:
match => [ "message", "(?m)%{TIMESTA...
My final grok for Vertica log using (?m) and [^\n]+
match => ["message","(?m)%{TIMESTAMP_ISO8601:ClientTimestamp}%{SPACE}(%{DATA:Action}:)?(%{DATA:ThreadID} )?(\[%{DATA:Module}\] )?(\<%{DATA:Level}\> )?(\[%{DATA:SubAction}\] )?(@%{DATA:Nodename}:)?( (?<Session>(\{.*?\} )?.*?/.*?): )?(?<message>[^\n]+)((\n)?(\t)?(?<StackTrace>[^\n]+))?"]
Thanks to asperla
https://github.com/elastic/logstash/issues/2282
All GREEDYDATA
is is .*
, but .
doesn't match newline, so you can replace %{GREEDYDATA:message}
with (?<message>(.|\r|\n)*)
and get it to be truly greedy.