How to combine multilines to a single entry in kibana for a log

[nikhilesh]

Hi Team,

Below is the log file , I need to achieve the below scenario's please help me on this.

Scenario 1:

Right now, I was getting the logs in the Kibana dashboard as below. I want all the multiline in the logs should get in to the Kibana as a single entry in the message field (instead of multiple entries for multi lines). can I get the multiline pattern syntax to achieve the same (or) is there any alternative solution for that

FYI.. I am using logstash with multiple hostnames.

Scenario 2:
How the get all the multiline of the log in to a single entry (how to get in to multiple columns (column 1, column2 ,.....)

Example as below . (instead log.file.path as a column, I want another line to get as side by side)

Log file:

dn: cn=dc=micall,dc=com,cn=domains,cn=Multimaster Synchronization,cn=Synchronization Providers,cn=config
objectClass: top
objectClass: ds-cfg-replication-domain
cn: dc=micall,dc=com
ds-cfg-base-dn: dc=micall,dc=com
ds-pwp-password-expiration-time: 20220222062506.252Z
entryDN: cn=dc=micall,dc=com,cn=domains,cn=Multimaster Synchronization,cn=Synchronization Providers,cn=config
entryUUID: 3c41d1f5-b7ab-3cc3-ab4b-b8ef29e119e7
etag: 00020000c39421e9
hasSubordinates: false
numSubordinates: 0
pwdPolicySubentry: cn=Default Password Policy,cn=Password Policies,cn=config
structuralObjectClass: ds-cfg-replication-domain
subschemaSubentry: cn=schema

Thanks
Nick

[thomasneirynck]

hi @nikhilesh

scenario 1:

This is a logstash question. Here is a tutorial to deal with multi-line logs: Managing Multiline Events | Logstash Reference [7.11] | Elastic

You'll end up using the multiline "codec". So you'd end up writing a multiline rule that looks for the dn: pattern to indicate the start of your multiline log.

scenario 2:

Once you have done (1), it's concatenated in a single message. You can use a grok pattern to read out the actual values. See here for more Grok filter plugin | Logstash Reference [master] | Elastic

[nikhilesh]

Thanks so much.

coming to scenario 1 , my log is not having the dn: pattern as a starting of the multi lines. starting string differ line to line. can you please help me out the exact pattern which can apply?

Thanks
nick