Can we use multiline plugin with logstash input journald plugins in logstash?

Elastic Stack Logstash
1

input {
journald {
lowercase => true
seekto => "tail"
thisboot => true
type => "journald"
codec => multiline {
pattern => "(^%{TIMESTAMP_ISO8601})"
negate => "true"
what => previous
}
tags => [ "journald" ]
path => "/run/log/journal"
sincedb_path => "/tmp/.sincedb_journal"
}
}

is it right to use multiline concept with journald input plugins which is mention above?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.