Hello! I want to use multiline codec patterns in my use case.. Here I want to read the multiple lines as one event

My input logs looks like:

START the log printing 08/09/2019 10:12:45


END the log printing 08/09/2019 10:13:05

Can anyone please provide the input filter with multiline codec

Note: In the above input logs the hypen is overirded with space

Try something like below in your input section.
You only need to create regex to catch start of your block.
In my case it's timestamp so i'm using pattern => "%{TIMESTAMP_ISO8601}"

file {
	path => ["/path/to/your/file.log"]
	codec => multiline {
		pattern => "regex_matching_start_of_your_event"
		negate => true
		what => previous

and then parse received message using grok if needed.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.