Error loading configuration after upgrading to 5.0.1

Elastic Stack Logstash
1

I am getting the following error:

"Couldn't find any filter plugin named 'multiline'. Are you sure this is correct? Trying to load the multiline filter plugin resulted in this error: LoadError"}

What wrong?

Thanks
Sharon.

2

Was the multiline deprecated in 5.0.1?
What are the alternatives?

How I do it?

Thanks
Sharon.

3

Is the plugin installed?

$bin/logstash-plugin list
4

The multiline filter has been deprecated. It generally makes sense to do multiline processing as close to the source as possible, so if you are using Filebeat, which supports multiline processing, you can do it there. In Logstash the recommended approach is to use the multiline codec instead of the filter.

1 Like
5

But if I set it as multiline code in the logstash.conf, can I set various input patterns for input files from filebeat? I have various input file, each start with different unique pattern .

6

If you are using Filebeat, perform the multiline processing there instead of in Logstash.

7

Yes, that's exactly what I am trying to do, but now, I have issues hot to define the multiline.pattern field in the prospector.
Before, I was using a unique patter that I defined in my patter file.

*Maybe I need to open this question on the filebeat page?

8

The earlier to can do the multiline processing the better, so I would recommend opening a topic around you issue in the Filebeat section.

1 Like
9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.