Disable/enable multiline codec when using clone filter

[nino]

Hello all,

is it posible to disable multiline when using clone filter?. For instance:

input{

    codec => multiline { 
          pattern => "^ImposibleMatch"
          negate => true
          what => previous
          auto_flush_interval => 1
          multiline_tag => ""
        }
    }

    filter{

       clone { clones =>  ["multilineOff"]  } 

       if [type] == "multilineOff" {
          ### treat file as no multiline, one line, one event (bypassing multiline code on input) 
       }
       else{
          ### treat file as multiline (input multiline codec takes effect) 
       }

}

Best regards

[nino]

Any suggestion about that?. My question it's about, what happens when we have to divide a file in two or more indexes.

Best regards

[Badger]

If you have combined multiple lines into a single event you could split that event into multiple events using a split filter.

[nino]

Thank you Badger. I am wondering which would be the best approach. Maybe the best approach if you have to divide the same file in several indexes would be create as pipelines as indexes we need. What do you think about this approach? One pipeline per index to route for, just to avoid very large conf files (pipelines) or better maintenance, could you give me some advice?

Best regards

[Badger]

The forked-path pattern to process the same data in multiple ways is a good approach.