I am writing a filebeat configuration when I am matching if a line starts with a number like 03:32:33 ( a timestamp). I am currently doing it by-
\d
But its not getting recognised, is there anything else which I should do. I am not particularly good/ have experience with regex. Help will be appreciated.
The real problem is that filebeat does not support \d
.
Replace \d
by [0-9]
and your regular expression will work.
I suggest you to give a look at the filebeat's Supported Patterns.
Also, be sure you've used ^
, it stands for the start of the string.