We collect logs from journald default location where docker containers puts logs through stderr/stdout. default field name for log message is "log". If i want to use multi codec plugin inside logstash does it expect log message in a "message" field, if yes how can i specify a field name ?
A multiline codec always creates events with a field called [message]. You cannot configure that.
What if my input is in json format with other fields. The apllication container log is in field called "log" along with other kuberetes metadata inforamation. in this case how can i configure multiline to work ??
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.