0101-15:17:39:012|aze|exp|id|aa|bb|ee|rr|zz|tt|jj
0101-15:17:39:012|aze|exp|id....|ERR exception
nom du para: sss
à System...
à Web.............|Ref|lev|15|Code_Status = 50
0101-15:17:39:012|aze|exp|id|aa|bb|ee|rr|zz|tt|jj
the problem is that logstash reads the file line by line so it added a message with "para name:sss"...
can logstash keep some lines on a single line or create those lines in a single message?
About multiline, sometimes I have log files that don't contain "ERR exception".
So I don't know if there is a solution for this
Thank you so much for the reply it works,
Just one more question when i have beats file in input the multiline didnt work under beats { } in logstash ?
I mean like this:
Indeed, as the documentation notes, you should not use a multiline codec with a beats input because it might combine lines from multiple senders. Do it in the beat instead.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.