Add 'multiline' to tags field

Elastic Stack Beats
1

The logstash multiline plugin adds the value 'multiline' to tags. Then it is possible to perform additional processing of such events:

if 'multiline' in [tags] {  .... } Are there plans to add this into Filebeat?
1 Like
2

I'm curious, what conditional extra processing do you perform just because the line was joined from multiple physical lines?

3 
if 'multiline' in [tags] {
  mutate { # Replace all new line characters with a label.
    gsub => [ '[@metadata][message]', '\n', '<<NEWLINE>>' ] 
  }
}

The newline characters are replaced with a label which another system uses to parse the line.

4

Feel free to add an enhancement request to github.com/elastic/beats. Some indicator to flag merged lines totally makes sense.

5

Enhancement to include indication of a multiline has been recorded.

1 Like