How to deal with different log in input?

Elastic Stack Logstash
1

I have a lot of logs to deal,they have different format. For example, some are one log with one line, but some are one log with several lines.

First I use multiline in filter, but the logstash show: Defaulting pipeline worker threads to 1 because there are some filters that might not work with multiple worker threads {:count_was=>32, :filters=>["multiline", "multiline"], :level=>:warn}

the logstash's efficiency is very low.

then,I config like this:
1 input {
2 beats {
3 port => 5044
4 }
5
6 if "test1.log" in [source] {
7 codec => multiline {
8 pattern => "^\s"
9 what => "previous"
10 }
11 }
12 }
but the config is wrong.

I want to use codec multiline only on test1.log, and I want to use only a beat port, how to config?

2

You cannot use conditionals in inputs.
Look at leveraging filebeat with it's multiline capabilities.

3

ok, thanks for your reply