From 65ca2de7efaf9d06126246eda5b5754fcae0f18c Mon Sep 17 00:00:00 2001 From: Luca Belluccini Date: Fri, 5 Apr 2024 16:00:18 +0200 Subject: [PATCH] Include plugin.id in the plain text log format (#36727) Co-authored-by: Nathan L Smith --- filebeat/module/logstash/log/ingest/pipeline-plaintext.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/filebeat/module/logstash/log/ingest/pipeline-plaintext.yml b/filebeat/module/logstash/log/ingest/pipeline-plaintext.yml index 4c75de47c99..e506b0bc97b 100644 --- a/filebeat/module/logstash/log/ingest/pipeline-plaintext.yml +++ b/filebeat/module/logstash/log/ingest/pipeline-plaintext.yml @@ -13,6 +13,8 @@ processors: (.| )* patterns: + - \[%{TIMESTAMP_ISO8601:logstash.log.timestamp}\]\[%{LOGSTASH_LOGLEVEL:log.level}\s?\]\[%{LOGSTASH_CLASS_MODULE:logstash.log.module}\s*\]\[%{NOTSPACE:logstash.log.pipeline_id}\]\[%{NOTSPACE:logstash.log.plugin_id}\] + %{GREEDYMULTILINE:message} - \[%{TIMESTAMP_ISO8601:logstash.log.timestamp}\]\[%{LOGSTASH_LOGLEVEL:log.level}\s?\]\[%{LOGSTASH_CLASS_MODULE:logstash.log.module}\s*\]\[%{NOTSPACE:logstash.log.pipeline_id}\] %{GREEDYMULTILINE:message} - \[%{TIMESTAMP_ISO8601:logstash.log.timestamp}\]\[%{LOGSTASH_LOGLEVEL:log.level}\s?\]\[%{LOGSTASH_CLASS_MODULE:logstash.log.module}\s*\]