How to combine multilines to a single entry in kibana for a log

Hi Team,

Below is the log file , I need to achieve the below scenario's please help me on this.

Scenario 1:

Right now, I was getting the logs in the Kibana dashboard as below. I want all the multiline in the logs should get in to the Kibana as a single entry in the message field (instead of multiple entries for multi lines). can I get the multiline pattern syntax to achieve the same (or) is there any alternative solution for that

FYI.. I am using logstash with multiple hostnames.

Scenario 2:
How the get all the multiline of the log in to a single entry (how to get in to multiple columns (column 1, column2 ,.....)

Example as below . (instead log.file.path as a column, I want another line to get as side by side)

Log file:

dn: cn=dc=micall,dc=com,cn=domains,cn=Multimaster Synchronization,cn=Synchronization Providers,cn=config
objectClass: top
objectClass: ds-cfg-replication-domain
cn: dc=micall,dc=com
ds-cfg-base-dn: dc=micall,dc=com
ds-pwp-password-expiration-time: 20220222062506.252Z
entryDN: cn=dc=micall,dc=com,cn=domains,cn=Multimaster Synchronization,cn=Synchronization Providers,cn=config
entryUUID: 3c41d1f5-b7ab-3cc3-ab4b-b8ef29e119e7
etag: 00020000c39421e9
hasSubordinates: false
numSubordinates: 0
pwdPolicySubentry: cn=Default Password Policy,cn=Password Policies,cn=config
structuralObjectClass: ds-cfg-replication-domain
subschemaSubentry: cn=schema


hi @nikhilesh

scenario 1:

This is a logstash question. Here is a tutorial to deal with multi-line logs: Managing Multiline Events | Logstash Reference [7.11] | Elastic

You'll end up using the multiline "codec". So you'd end up writing a multiline rule that looks for the dn: pattern to indicate the start of your multiline log.

scenario 2:

Once you have done (1), it's concatenated in a single message. You can use a grok pattern to read out the actual values. See here for more Grok filter plugin | Logstash Reference [master] | Elastic

Thanks so much.

coming to scenario 1 , my log is not having the dn: pattern as a starting of the multi lines. starting string differ line to line. can you please help me out the exact pattern which can apply?


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.