Include plugin.id in the plain text log format (#36727)

Co-authored-by: Nathan L Smith <[email protected]>
elastic · Apr 5, 2024 · 65ca2de · 65ca2de
1 parent a455d05
commit 65ca2de
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/filebeat/module/logstash/log/ingest/pipeline-plaintext.yml b/filebeat/module/logstash/log/ingest/pipeline-plaintext.yml
@@ -13,6 +13,8 @@ processors:
         (.|
         )*
     patterns:
+    - \[%{TIMESTAMP_ISO8601:logstash.log.timestamp}\]\[%{LOGSTASH_LOGLEVEL:log.level}\s?\]\[%{LOGSTASH_CLASS_MODULE:logstash.log.module}\s*\]\[%{NOTSPACE:logstash.log.pipeline_id}\]\[%{NOTSPACE:logstash.log.plugin_id}\]
+      %{GREEDYMULTILINE:message}
     - \[%{TIMESTAMP_ISO8601:logstash.log.timestamp}\]\[%{LOGSTASH_LOGLEVEL:log.level}\s?\]\[%{LOGSTASH_CLASS_MODULE:logstash.log.module}\s*\]\[%{NOTSPACE:logstash.log.pipeline_id}\]
       %{GREEDYMULTILINE:message}
     - \[%{TIMESTAMP_ISO8601:logstash.log.timestamp}\]\[%{LOGSTASH_LOGLEVEL:log.level}\s?\]\[%{LOGSTASH_CLASS_MODULE:logstash.log.module}\s*\]