How to separate a log line by line

Elastic Stack Beats
1

Hi,

I'm pretty new here and I am experimenting with ELK. One thing I couldn't figure out until now is: How can I parse a log line by line with each line becoming its own event?
For example, I have a log file which looks like this:
! 123 ! 456 ! abc ! def ! 009 !
! 123 ! 456 ! abc ! def ! 009 !
! 123 ! 456 ! abc ! def ! 009 !
! 123 ! 456 ! abc ! def ! 009 !

Each line has the same build up but I don't want it to be processed as "multiline". How can I process the logfile in a way that each line becomes it's own message?

2

Hi, thanks for reaching out! Which module in Filebeat are you using? Or are you using the log file as input?

3

Hi Kaiyan_Sheng,
Already solved it. It was a misconfiguration within the Filebeat still having a multi-line parameter active :slight_smile:
After deleting, it worked fine!

4

Hi Ben,

Would you mind providing the filebeat.yml file? We are also facing the similar issue. After excluding the multi-line parameter the lines were not coming in the log. But the problem is if we add the multiline parameter in filebeat.yml we should be getting the logs but it should be coming in single line rather than multiple line. Need your help. Any help would be appreciated.

Regards
Pradeep

5

Hi,

Thanks for quick response. We are using logfile as input which is collected from different sources and filebeat formats the nginx log before forwarding to graylog. The problem is for some misconfigurations of filebeat which result in multiline. Need your help in fixing this issue.

Regards
Pradeep

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.