Guidance for parsing log file

Elastic Stack Logstash
1

hi dears
I trying to pars some log files for WebSphere MQ and I'm not familiar with this logs, some lines of those logs different with others lines. for example :
""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
2018-10-19 13:52:16,188 DEBUG -org.springframework.jms.core.JmsTemplate - Sending created message:
JMS Message class: jms_bytes
JMSType: null
JMSDeliveryMode: 2
JMSExpiration: 0
JMSPriority: 4
JMSMessageID: null
JMSTimestamp: 0
JMSCorrelationID:null
JMSDestination: null
JMSReplyTo: null
JMSRedelivered: false
Integer encoding: 1, Floating point encoding 256
342334eseffsdgyfuk8a6ad576c42ffc30477955eb8f43840596286561521b994e9c448c
f6424b8c4efluglusad3e16752fde484225f81a43c4499a0c9556c12b3417b67a6b57848b11f65ab1
ec00480d1f0fbea414f7881ac190bdf5b705e49471d7da626e2a922f81b0edc10aa179a75a2e87bb6c0be8955591c4d9700c
""""""""""""""""""""""""""""""""""""""""""""""""

and the other line may look like this :

"""""""""
2018-10-19 13:52:16,226 DEBUG -com.ada.msas.switchingImpl.SwitchingImpl - 1470490# SwitchingImpl.switching msg :
SERVICE_CODE:00 ACCOUNT_NUMEBR:00000000000000 REQUEST_DATE_TIME:0 AMOUNT:000005000000 ACTION_CODE:0000 RESPONSE_DATE_TIME:0000000000000 ORIGIN_ACTION_CODE:00 SOURCE_TYPE:2 LATITUDE:0.0 LONGITUDE:0.0 PARENT_IMF:0 OPERATOR_TYPE:0 STAN:000000000 DIRECTION:RES INTERNAL_ID:00000000 MEDIA_TYPE:0 TOPUP_TYPE:0 TOPUP_PROFILE:0

"""""""""""""""""""""""""""""""""""""""""""""""

how can I read those lines with logstash? the both of these line logged in one file.

2

Use a file input with a multiline codec

codec => multiline {
    pattern => "^%{TIMESTAMP_ISO8601} "
    negate => true
    what => "previous"
}
3

thanks for reply, could you please describe it to me step by step?! i'm not fimiliar with multiline, what plugins should i install?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.