Add 'multiline' to tags field

(Wayne Hunter) #1

The logstash multiline plugin adds the value 'multiline' to tags. Then it is possible to perform additional processing of such events:

if 'multiline' in [tags] {  .... } Are there plans to add this into Filebeat?

Multiline is not getting added to the "tag" field
(Magnus Bäck) #2

I'm curious, what conditional extra processing do you perform just because the line was joined from multiple physical lines?

(Wayne Hunter) #3
if 'multiline' in [tags] {
  mutate { # Replace all new line characters with a label.
    gsub => [ '[@metadata][message]', '\n', '<<NEWLINE>>' ] 

The newline characters are replaced with a label which another system uses to parse the line.

(Steffen Siering) #4

Feel free to add an enhancement request to Some indicator to flag merged lines totally makes sense.

(Wayne Hunter) #5

Enhancement to include indication of a multiline has been recorded.

(system) #6