Include plugin.id in the plain text log format (elastic#36727)

Co-authored-by: Nathan L Smith <nathan.smith@elastic.co>
zeynepyz · Apr 7, 2024 · e23fe97 · e23fe97
1 parent 88a83d5
commit e23fe97
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/filebeat/module/logstash/log/ingest/pipeline-plaintext.yml b/filebeat/module/logstash/log/ingest/pipeline-plaintext.yml
@@ -13,6 +13,8 @@ processors:
         (.|
         )*
     patterns:
+    - \[%{TIMESTAMP_ISO8601:logstash.log.timestamp}\]\[%{LOGSTASH_LOGLEVEL:log.level}\s?\]\[%{LOGSTASH_CLASS_MODULE:logstash.log.module}\s*\]\[%{NOTSPACE:logstash.log.pipeline_id}\]\[%{NOTSPACE:logstash.log.plugin_id}\]
+      %{GREEDYMULTILINE:message}
     - \[%{TIMESTAMP_ISO8601:logstash.log.timestamp}\]\[%{LOGSTASH_LOGLEVEL:log.level}\s?\]\[%{LOGSTASH_CLASS_MODULE:logstash.log.module}\s*\]\[%{NOTSPACE:logstash.log.pipeline_id}\]
       %{GREEDYMULTILINE:message}
     - \[%{TIMESTAMP_ISO8601:logstash.log.timestamp}\]\[%{LOGSTASH_LOGLEVEL:log.level}\s?\]\[%{LOGSTASH_CLASS_MODULE:logstash.log.module}\s*\]