I am reading multiline from input and trying to match all the instances of the pattern. but it only output the first instance and not the rest. I'm not sure where I am making the mistake. this is my conf file content:
indent preformatted text by 4 spaces
input {
file {
path => "/usr/local/src/logstash/log1.in"
start_position => beginning
sincedb_path => "/dev/null"
codec => multiline {
pattern => "^show"
negate => true
what => next
}
}
}
filter {
grok {
patterns_dir => ["./patterns/mypatterns"]
match => {"message" => ["(?m)configure vlan %{WORD:vlan} add ports %{PORTS:ports} %{TAG_INFO:tag_info}"]}
break_on_match => false
}
}
output {
stdout {
codec => rubydebug
}
}
and this is the content of log1.in( I only have one 'show switch' command)
configure snmp sysName "NY_MPBN_SS_1"
configure snmp sysLocation "GSI New York"
configure snmp sysContact "JPoserio@globecommsystems.com"
configure timezone name New_Yor -240
configure sys-recovery-level switch reset
configure vlan CH_ACCESS add ports 19, 28, 46-47 tagged
configure vlan CN_GN add ports 10, 46-47 tagged
configure vlan CN_GN add ports 12 untagged
configure vlan CN_Gn_GSN_1 add ports 3-8, 46 tagged
configure vlan Default add ports 50 untagged
show switch
and this is the output of running the conf file