Regex for multiline string in filebeat - filebeat

Question

I'm using filebeat to aggregate errors and send alarms, I want to use multiline option in filebeat.yml file to extract errors and all words around this error from below log:
2019-07-02 16:00:00.037 [SUBSCRIBER_PROFILE-1157917705-d73442b7-8d07-4aee-a850-09aa51ff37e2] ********************Inquiry Item [com.etisalat.oms.inquiry.actions.Voi
ceMinutesCrossNetInquiry] Executed successfully**************************
2019-07-02 16:00:00.037 [SUBSCRIBER_PROFILE-1157917705-d73442b7-8d07-4aee-a850-09aa51ff37e2] Service Class [com.etisalat.oms.inquiry.actions.GeneralUnitsInquiry] l
oaded Successfully.
2019-07-02 16:00:00.037 [SUBSCRIBER_PROFILE-1157917705-d73442b7-8d07-4aee-a850-09aa51ff37e2] *************************** Starting Inquiry Item [com.etisalat.oms.in
quiry.actions.GeneralUnitsInquiry] *****************
2019-07-02 16:00:00.037 [SUBSCRIBER_PROFILE-1157917705-d73442b7-8d07-4aee-a850-09aa51ff37e2] Starting GeneralUnitsInquiry.execute ...
2019-07-02 16:00:00.037 [SUBSCRIBER_PROFILE-1157917705-d73442b7-8d07-4aee-a850-09aa51ff37e2] attributeType[UC], attributeValue[713], attributeMinValue[0], attribut
eMaxValue[null], attributeSubValue[71301]
2019-07-02 16:00:00.037 [SUBSCRIBER_PROFILE-1157917705-d73442b7-8d07-4aee-a850-09aa51ff37e2] ********************Inquiry Item [com.etisalat.oms.inquiry.actions.Gen
eralUnitsInquiry] Executed successfully**************************
2019-07-02 16:00:00.400 [ELIGIBLE_PRODUCT-1122220199-4b666699-b9b0-4549-8aff-537b199e040d] No product found for the RTIM offer name null
2019-07-02 16:00:00.400 [ELIGIBLE_PRODUCT-1122220199-4b666699-b9b0-4549-8aff-537b199e040d] Error While Processing Request [<?xml version="1.0" encoding="UTF-8"?>
<eligibleProductsRequest>
<channel>myEtisalatApp</channel>
<extraRequestParameters>
<name>INTERACTION_POINT</name>
<value>meaHomePage</value>
</extraRequestParameters>
<extraRequestParameters>
<name>APP_LANGUAGE</name>
<value>EN</value>
</extraRequestParameters>
<extraRequestParameters>
<name>APP_VERSION</name>
<value>9</value>
</extraRequestParameters>
<requestType>BEST_OFFER</requestType>
<transactionId>860acdaa2fc04ca88c7016d4f56b083d</transactionId>
<msisdn>1122220199</msisdn>
</eligibleProductsRequest>
].
com.etisalat.oms.exception.ApplicationException: No eligible product configured for this dial [1122220199]
at com.etisalat.oms.inquiry.manager.GenericProductEligibility.postValidate(GenericProductEligibility.java:72) ~[oms.jar:?]
at com.etisalat.oms.inquiry.manager.GenericProductEligibility.getEligibleProduct(GenericProductEligibility.java:42) ~[oms.jar:?]
at com.etisalat.oms.interfaces.service.ProductManagementService.getEligibleProducts(ProductManagementService.java:179) ~[oms.jar:?]
at com.etisalat.oms.interfaces.product.EligibleProductsHandler.handle(EligibleProductsHandler.java:47) [oms.jar:?]
at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1115) [jetty-all-9.3.1.v20150714-uber.jar:9.3.1.v20150714]
at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1051) [jetty-all-9.3.1.v20150714-uber.jar:9.3.1.v20150714]
at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141) [jetty-all-9.3.1.v20150714-uber.jar:9.3.1.v20150714]
at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:213) [jetty-all-9.3.1.v20150714-uber.jar:9.3.1.v20150714]
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:119) [jetty-all-9.3.1.v20150714-uber.jar:9.3.1.v20150714]
at org.eclipse.jetty.server.Server.handle(Server.java:517) [jetty-all-9.3.1.v20150714-uber.jar:9.3.1.v20150714]
at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:302) [jetty-all-9.3.1.v20150714-uber.jar:9.3.1.v20150714]
at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:242) [jetty-all-9.3.1.v20150714-uber.jar:9.3.1.v20150714]
at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:238) [jetty-all-9.3.1.v20150714-uber.jar:9.3.1.v20150714]
at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:95) [jetty-all-9.3.1.v20150714-uber.jar:9.3.1.v20150714]
at org.eclipse.jetty.io.SelectChannelEndPoint$2.run(SelectChannelEndPoint.java:57) [jetty-all-9.3.1.v20150714-uber.jar:9.3.1.v20150714]
at org.eclipse.jetty.util.thread.strategy.ExecuteProduceConsume.produceAndRun(ExecuteProduceConsume.java:213) [jetty-all-9.3.1.v20150714-uber.jar:9.3.1.v20
150714]
at org.eclipse.jetty.util.thread.strategy.ExecuteProduceConsume.run(ExecuteProduceConsume.java:147) [jetty-all-9.3.1.v20150714-uber.jar:9.3.1.v20150714]
at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:654) [jetty-all-9.3.1.v20150714-uber.jar:9.3.1.v20150714]
at org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java:572) [jetty-all-9.3.1.v20150714-uber.jar:9.3.1.v20150714]
at java.lang.Thread.run(Thread.java:745) [?:1.8.0_65]
I used the below pattern but it doesn't get all chunk of log:
^\</|^[[:space:]]+\b|^Exception:

Answer 1

Try the config like this (take into account that pattern is negated):
filebeat.inputs:
- type: log
enabled: true
# https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html
multiline.pattern: '^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.'
multiline.negate: true
multiline.match: after