在filebeat.yml设置“include_lines”问题

今天在“filebeat.yml”文件中设置 include_lines: ['WARN'] 时，发现一个问题。
filebeat.yml 中设置如下

当输出文件含有的 WARN 行如下时，启动filebeat后，没有输出。
[2019-11-26 17:56:56,542] WARN Client session timed out, have not heard from server in 8623ms for sessionid 0x20004962acd0000 (org.apache.zookeeper.ClientCnxn)
[2019-11-26 17:56:57,788] WARN Unable to reconnect to ZooKeeper service, session 0x20004962acd0000 has expired (org.apache.zookeeper.ClientCnxn)
[2019-11-26 17:57:21,270] WARN Client session timed out, have not heard from server in 2311ms for sessionid 0x0 (org.apache.zookeeper.ClientCnxn)
 
但当“WARN”字符前后，且只要有一个WARN前后有“[”和“]”后，即“[WARN]”，启动filebeat后，有输出。
[2019-11-26 17:56:56,542] [WARN] Client session timed out, have not heard from server in 8623ms for sessionid 0x20004962acd0000 (org.apache.zookeeper.ClientCnxn)
[2019-11-26 17:56:57,788] WARN Unable to reconnect to ZooKeeper service, session 0x20004962acd0000 has expired (org.apache.zookeeper.ClientCnxn)
[2019-11-26 17:57:21,270] WARN Client session timed out, have not heard from server in 2311ms for sessionid 0x0 (org.apache.zookeeper.ClientCnxn)
上面三行“WARN”中，有且只有一个“[WARN]”时，则会触发输出，并且会输出上面的三行。
 
实际上，有的输出文件里，是没有中括号[]，那怎么才能触发输出呢？