Error loading configuration after upgrading to 5.0.1

(Sharon Sasporta) #1

I am getting the following error:

"Couldn't find any filter plugin named 'multiline'. Are you sure this is correct? Trying to load the multiline filter plugin resulted in this error: LoadError"}

What wrong?


(Sharon Sasporta) #2

Was the multiline deprecated in 5.0.1?
What are the alternatives?

How I do it?


(Ben) #3

Is the plugin installed?

$bin/logstash-plugin list

(Christian Dahlqvist) #4

The multiline filter has been deprecated. It generally makes sense to do multiline processing as close to the source as possible, so if you are using Filebeat, which supports multiline processing, you can do it there. In Logstash the recommended approach is to use the multiline codec instead of the filter.

(Sharon Sasporta) #5

But if I set it as multiline code in the logstash.conf, can I set various input patterns for input files from filebeat? I have various input file, each start with different unique pattern .

(Christian Dahlqvist) #6

If you are using Filebeat, perform the multiline processing there instead of in Logstash.

(Sharon Sasporta) #7

Yes, that's exactly what I am trying to do, but now, I have issues hot to define the multiline.pattern field in the prospector.
Before, I was using a unique patter that I defined in my patter file.

*Maybe I need to open this question on the filebeat page?

Something wrong with notifications?
(Christian Dahlqvist) #8

The earlier to can do the multiline processing the better, so I would recommend opening a topic around you issue in the Filebeat section.

(system) #9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.