PROSAGA码农传奇-ELK-正确的ELK多线正则表达式？

<div class =“post-text”itemprop =“text”>
  <P>
    首先你必须修复你的多线模式：
  </p>
   <pre>
    <code>
      codec => multiline {
            pattern => "^%{NUMBER:method_id}\|%{DATA:method_type}\|<soapenv:Envelope>"
            negate => true
            what => previous
        }

</code>
  </pre>
  <P>
    之后您可以使用Wiktor在评论中建议的模式：
  </p>
   <pre>
    <code>
      (?m)^(?<method_id>\d+)\|(?<method_type>\w+)\|(?<request><soapenv:Envelope>.*?</soapenv:Envelope>)\|(?<response><soapenv:Envelope>.*?</soapenv:Envelope>)

</code>
  </pre>
  <P>
    在您的帖子中显示三个日志行的结果
    <a href="http://grokconstructor.appspot.com" rel="nofollow noreferrer">
      http://grokconstructor.appspot.com
    </A>
    ：

<a href="https://i.stack.imgur.com/H1nhP.png" rel="nofollow noreferrer">
      <img src =“https://i.stack.imgur.com/H1nhP.png”alt =“results”/>
    </A>
  </p>
  <HR />
  <P>
    您的整个配置可能如下所示：
  </p>
   <pre>
    <code>
      input {
  file {
    path => "/opt/test5/practice_new/xml_input.dat"
    start_position => "beginning"
    codec => multiline {
            pattern => "^%{NUMBER:method_id}\|%{DATA:method_type}\|<soapenv:Envelope>"
            negate => true
            what => previous
        }
  }
}
filter {
  grok {
    match => [ "message", "(?m)^(?<method_id>\d+)\|(?<method_type>\w+)\|(?<request><soapenv:Envelope>.*?</soapenv:Envelope>)\|(?<response><soapenv:Envelope>.*?</soapenv:Envelope>)" ]
  }
}

output {
   elasticsearch {
     hosts => "http://localhost:9200"
     index => "xml"
  }
stdout {}
}

</code>
  </pre>
</DIV>