Each log line is split into a different document in Elastic

[Merav_Yaacov]

Hi,
What can be the reason that each line of log file is split into single document in Elastic?
That's how Logstash is configured:

input {
  file {
        type => "log"
        path => ["/etc/logstash/conf.d/files/*.log"]
        sincedb_path => "/etc/logstash/conf.d/sincedb.log"                                                                                                                                     }
}

output {
  stdout {
        codec => rubydebug
  }
  elasticsearch {
        hosts => ["https://<hostname>:9200"]
        index => "failure-logs"
        user => "elastic"
        password => "****"
        ssl => true
        cacert => "/etc/logstash/conf.d/ca.crt"
  }
}

In Elastic each line is populated into different document.

Thanks

[Badger]

@Merav_Yaacov

In Elastic each line is populated into different document.

That is working as expected. A file input consumes files one line at a time. If you need to combine lines you may want to use a multiline codec.

[Merav_Yaacov]

Got it. Thank you!

[Rios]

A simplified version ML coded of this:

input {
  file {
    path => "/path/file.log"
    sincedb_path => "/dev/null"
    start_position => "beginning"
      codec => multiline {
      pattern => "^<pattern>" # how LS will recognize what is the first line
      negate => "true"
      what => "previous"
    }
}