Entire File as "one line"

Elastic Stack Logstash
1

Is there a good strategy to read an entire file as the "message" value you would send to ElasticSearch?

I see "read" mode as part of file input plugin but that wants me to write the input to a different file. I want to take what I've read and push it to Elastic Search.

I tried using the codec for multiline but didn't know how to use the end of file as the pattern.

The system i'm trying to parse writes a new file for every error so the whole file is what I need to consume. A new error, writes a new file.

Any suggestions?

2

Use a pattern that never matches and a timeout. I use

codec => multiline { pattern => "^Spalanzani" negate => true what => previous auto_flush_interval => 1 }
3

Brilliant!!! I was trying to attack it with a pattern that always matched. I also think the fact that I wasn't using the auto_flush_interval attribute was causing some sort of issue.

This works perfectly!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.