Unable to Create Custom Extracted Field from Multi-line Events in Log Insight 4.x

Products

• VMware Aria Suite

Issue/Introduction

Symptoms:

• When attempting to create a custom extracted field from a multi-line event in Log Insight 4.x, the field will not extract past the first line.

Environment

VMware vRealize Log Insight 4.3.x
VMware vRealize Log Insight 4.6.x
VMware vRealize Log Insight 4.5.x
VMware vRealize Log Insight 4.x
VMware vRealize Log Insight 4.0.x

Resolution

This issue is resolved in vRealize Log Insight 4.6.1 and higher, available at VMware Downloads.

Workaround:

To work around this issue, update the extracted field by replacing all spaces, tabs and new lines with "\s*" in the pre and post contexts

Example:

pre: Failure Code:\s*

post: \s*Pre\-Authentication