I am using Multiline codec input plugin but the events which are not matching with my PATTERN it also processing those Events

Elastic Stack Logstash
1

Below is the codec which am using for multiline events.

codec => multiline {
	  pattern => "%{TIMESTAMP_ISO8601:syslogtime}\s%{WORD:str}\s%{WORD:s}\s%{YEAR:yeaa}-%{MONTHNUM:ooo}-%{MONTHDAY:ppp}\s%{TIME:trrrs}"
	  #pattern => "((^%{TIMESTAMP_ISO8601} %{WORD} %{WORD} %{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME}))"
	  negate => true
      what => "previous"
    }
2

How does the message/event look like?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.