I have a log like this:
2015-06-26 23:00:48,935 foo as "date1"
whatever lines not start with date
...
2015-06-16 18:46:16,136 bar as "date2"
I'm trying to get all lines between date1(include) and date2(exclude). So I use "multiline" filter:
filter {
grok {
match => {"message" => "%{TIMESTAMP_ISO8601:[@metadata][tt]} %{GREEDYDATA:[@metadata][dd]}"}
}
if "_grokparsefailure" not in [tags] {
date {
match => ["[@metadata][tt]", "yyyy-MM-dd HH:mm:ss,SSS"]
}
} else { # indicates this line should belong to previous message
multiline {
pattern => ".*"
what => "previous"
}
}
}
But it just generates 3 messages:
m1: 2015-06-26 23:00:48,935 foo
m2: 2015-06-16 18:46:16,136 bar
m3: whatever lines not start with date
...
What's wrong with the filter config? How to make it right? Thx in advance!