Disable/enable multiline codec when using clone filter

Hello all,

is it posible to disable multiline when using clone filter?. For instance:


    codec => multiline { 
          pattern => "^ImposibleMatch"
          negate => true
          what => previous
          auto_flush_interval => 1
          multiline_tag => ""


       clone { clones =>  ["multilineOff"]  } 

       if [type] == "multilineOff" {
          ### treat file as no multiline, one line, one event (bypassing multiline code on input) 
          ### treat file as multiline (input multiline codec takes effect) 


Best regards

Any suggestion about that?. My question it's about, what happens when we have to divide a file in two or more indexes.

Best regards

If you have combined multiple lines into a single event you could split that event into multiple events using a split filter.

Thank you Badger. I am wondering which would be the best approach. Maybe the best approach if you have to divide the same file in several indexes would be create as pipelines as indexes we need. What do you think about this approach? One pipeline per index to route for, just to avoid very large conf files (pipelines) or better maintenance, could you give me some advice?

Best regards

The forked-path pattern to process the same data in multiple ways is a good approach.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.