I am trying input a csv file that certain fields can be multiline. When I paste the sample data into Notepad++ and display end of line characters, I can see the actual csv line separates using CRLF but the new lines within a field use LF. I want all lines within one field to be one value in Elastic. Below is my input code. Any suggestions on how to input this properly?
input{
file {
path => "/home/ubuntu/csv_inputs/sca/*.csv"
start_position => "beginning"
sincedb_path => "/dev/null"
codec => multiline {
pattern => "\lf"
negate => true
what => previous
}
}
}