Add 'multiline' to tags field

The logstash multiline plugin adds the value 'multiline' to tags. Then it is possible to perform additional processing of such events:

if 'multiline' in [tags] {  .... } Are there plans to add this into Filebeat?
1 Like

I'm curious, what conditional extra processing do you perform just because the line was joined from multiple physical lines?

if 'multiline' in [tags] {
  mutate { # Replace all new line characters with a label.
    gsub => [ '[@metadata][message]', '\n', '<<NEWLINE>>' ] 

The newline characters are replaced with a label which another system uses to parse the line.

Feel free to add an enhancement request to Some indicator to flag merged lines totally makes sense.

Enhancement to include indication of a multiline has been recorded.

1 Like