How to handle overlapping logs with filebeat?

Elastic Stack Beats
1

Hi everyone
is there a way to handle overlapping logs with filebeat? here's a sample of what i have:

[17/02/2020 07:53:27:748] 00000 I >> message1 (start of event)
[17/02/2020 07:53:27:751] 00000 I @ message2
[17/02/2020 07:53:27:785] 00004 I >> message1 (start of event)
[17/02/2020 07:53:27:787] 00004 I @ message2
[17/02/2020 07:53:27:811] 00004 I  < message3
[17/02/2020 07:53:27:812] 00004 I << message4 (end of event)
[17/02/2020 07:53:27:834] 00000 I  < message3
[17/02/2020 07:53:27:835] 00000 I << message4 (end of event)

an event starts with >> and end with << having the same thread number
thanks in advance!

2

Hi!

From what I know, I dont think this is possible. Filebeat is a log parser that can handle multiline logs but not in a random order.

C.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.