Help with Multiline

Elastic Stack Logstash
1

Hi ,

I just came across an event where the log lines are of the format:

Date:2016-10-18
Time:14:31:05
Event Code:0x60a
Description:Internal information only. A logical unit has been enabled
Subsystem:CKM00124801986
Device:Bus 1 Enclosure 4 Disk 10
SP:SPA
Host:localhost
Source:N/A
Category:N/A
Log:Storage Array
Sense Key:0x0
Ext Code1:0x1cb01c4
Ext Code2:0x1e57140a
Type:Information

But i just cant get the multiline to work for this.

I tried:-
%{NUMBER}.\nDate:%{DATE_YMD}

Please help.

2

Hi,

Any help is appreciated.

Regards,
Debarun.

3

Is "1." the indicator that a new message begins? If so,

pattern => "^1\.$"
negate => true
what => previous

should work, i.e. "unless the line begins with '1.', join it with the previous line".

4

HI,

The loglines progress as 1. then 2., 3. and so on.

Regards,
Debarun.

5

Okay, so use ^\d+\.$ then.