elasticsearch - 多行的Grok模式不起作用

Question

1st | | 2nd | 3rd | 4th | 5th | 6th | 7th | 8th | 2012.07.12 05:31:04 | 10th | ProductDir:C:\ samplefiles \ test \ storage \ 4.0(LF)
C:\ samplefiles \ test \ storage \ 5.0(LF)
SampleDir:(LF)

注意:LF->换行被附加

我尝试了以下选项。.似乎没有任何作用

match => [ "message", "(?m)....

(?<message>(.|\r|\n)*)

Greedydata也不起作用，因为未考虑换行。

mutate {gsub => ["message", "\n", "LINE_BREAK"] }

编解码器=>多行{pattern =>“^ \ s”取反=> true what =>上一个}

Answer 1

(?m)%{GREEDYDATA}将匹配任何多行日志，包括您的日志。
请测试here