Dissect processor before multiline parser

Elastic Stack Beats
1

Hello,
I first want to filter prefixes from logs and then merge them into multiline. Currently you can do both as a single feature and also dissect after multiline, but you first can create multilines and then manipulate prefixes - the order is set.

  multiline.type: pattern
  multiline.pattern: '^.* \| \[[0-9]{4}-[0-9]{2}-[0-9]{2}'
  multiline.negate: true
  multiline.match: after

  processors:
    - dissect:
        tokenizer: "%{prefix} | %{message}"
        field: "message"
        target_prefix: ""

How would you currently handle it to get the reverse order?

2

You cannot change the order. Multiline aggregation is built into the input (like log or filestream), and processors are always run on the events emitted from the inputs.

The current design of processors doesn’t support aggregation, so we couldn’t move multiline into that stage. Processors follow a model of one event in and one event out, so this interface doesn’t allow aggregating multiple events into a single one.