Deleting post

Elastic Stack Logstash
1

Deleting this post

2

Any update on this please...

3

To multi line ... The better solution is filebeat/logshash.

Basically use o filebeat to filter the content e grok patterns to attribute fields

4

Hi Leandro,

I am using multiline plugin in logstash. I am not able to come up with a pattern which matches logs. Basically I am looking to extract highlighted fields above. I don't have any idea how to come up with a pattern to extract those fields.

5

Hi,

Have a try with multilne pluging to get all messages:

file {
    codec => multiline {
      pattern => "^Query ended"
      negate => true
      what => previous
    }

and then with filter you extract data you need.

pts0

6

Deleting post

7

Is there any other plugin that can be used to extract required fields? I think using Grok, we have to give exact match for logs. In my case logs are too large. Please suggest me the best way.