Collect multiple line in stdin

Elastic Stack Logstash
1

Hi,

Is it possible to read multiple lines at once?
The first line indicates the error. I would like to log the statement that causes the error.

    < 2021-04-07 10:19:18.883 CEST db dbuser App 37386 > ERROR:  operator does not exist: date = character varying at character 340
    < 2021-04-07 10:19:18.883 CEST db dbuser App 37386 > HINT:  No operator matches the given name and argument type(s). You might need to add explicit type casts.
    < 2021-04-07 10:19:18.883 CEST db dbuser App 37386 > STATEMENT:  select a.col1,a.col2 from TABLE a where ( col3= $1  AND col4= $2)

Thanks in advance for any help!

2

Yes, you can do that using a multiline codec if you can find an appropriate pattern.

3

(post withdrawn by author, will be automatically deleted in 24 hours unless flagged)

4

The only way I see is to detect a line having a different PID.

Example;

< 2021-04-07 10:19:18.883 CEST db dbuser App 23676 > FATAL: ....

The timestamp isn't very reliable though, but the PID is. The first three lines have PID = 37386, it should stop as soon as it detects a different PID in the log line.

I have no idea how to build the pattern. I am not a regex fun. :frowning:

5

In that case I would suggest using an aggregate filter with the PID as the task id. Look at example 3 in the documentation. In the code section you would do something like

code => '
    map["messages"] ||= []
    map["messages"]  << event.get("message")
    # Plus whatever else you need
'
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.