Hi Team, i am currently trying to load Multiline-files with Logstash but for some reason i can't get more than the first line. I know that this topic has been discussed several times but all the solutions won't work in my case. Some of my logs look like: [4428] Restart #34, SysUpTime 251d 16:46:5…

My assumption is that grok fails because the multiline doesn't properly assembles your lines the way you wish to. Your grok pattern assumes you combined the lines into one, but if you didn't, then it will fail. Let's take a look at the multiline. pattern => "^\S" You're matching everything that s…

Discuss the Elastic Stack

Can't parse multiline logs with grok

Elastic Stack Logstash

atira (Attila Boncok) May 4, 2018, 11:22am 4

You're welcome
Don't forget to mark a solution if you found one, it helps other users browsing for solutions.

1 Like

Topic		Replies	Views
Grok filter failing multiline logs from filebeat Logstash	2	1404	August 22, 2018
Logstash multiline Bug Logstash	2	1101	July 6, 2017
Question about multiline Logstash	1	311	July 27, 2019
Multiline log parsing from redis to logstash Logstash	4	789	March 27, 2017
Logstash unable to parse multiline Logstash	3	1120	November 9, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Can't parse multiline logs with grok

Related topics