Add 'multiline' to tags field


(Wayne Hunter) #1

The logstash multiline plugin adds the value 'multiline' to tags. Then it is possible to perform additional processing of such events:

if 'multiline' in [tags] {  .... } Are there plans to add this into Filebeat?

Multiline is not getting added to the "tag" field
(Magnus Bäck) #2

I'm curious, what conditional extra processing do you perform just because the line was joined from multiple physical lines?


(Wayne Hunter) #3
if 'multiline' in [tags] {
  mutate { # Replace all new line characters with a label.
    gsub => [ '[@metadata][message]', '\n', '<<NEWLINE>>' ] 
  }
} 

The newline characters are replaced with a label which another system uses to parse the line.


(Steffen Siering) #4

Feel free to add an enhancement request to github.com/elastic/beats. Some indicator to flag merged lines totally makes sense.


(Wayne Hunter) #5

Enhancement to include indication of a multiline has been recorded.


(system) #6