How to combine two lines based on the pattern

Elastic Stack Beats
1

I have the input logs like this:

C1 is completed on 2018-12-27.
C2 is running.
Now it is 2018-12-28.

What I want to output to ES is:
C1: 2018-12-27
C2: 2018-12-28

Basically it needs to combine line #2 and #3 into one line and use the pattern to parse the output, or parse #2 and #3 lines separately and then combine these two values together. How can I do that?

2

You can combine the lines via multiline settings in Beats.

Looks like you want to match on 'Now' when combining lines.
Try negate: true, match: before, and pattern: '^Now it is'.

The parsing you will have to do in Logstash I guess.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.