Hi,
I have a log file that has I need to support multiline parsing and I'm in the process of migrating from multiline filter to multiline codec
My input configuration is
file {
path => "c:/temp/test.log"
start_position => beginning
sincedb_path => "NUL"
ignore_older => 0
codec => multiline {
pattern => "^%{MONTHDAY} %{MONTH} %{YEAR} %{TIME}"
negate => true
what => previous
}
}
When the log file has
28 Oct 2016 19:35:48:Log Message 1
28 Oct 2016 19:35:48:Log Message 2
the output containts only the first message
{
"path" => "c:/temp/test.log",
"@timestamp" => 2016-11-16T16:44:07.738Z,
"@version" => "1",
"host" => "myhost",
"message" => "28 Oct 2016 19:35:48:Log Message 1\r",
"tags" => []
}
When the log file has
28 Oct 2016 19:35:48:Log Message 1
28 Oct 2016 19:35:48:Log Message 2
28 Oct 2016 19:35:48:Log Message 3a
Message 3b
28 Oct 2016 19:35:48:Log Message 4
the output has the first three messages but is missing Message 4
{
"path" => "c:/temp/test.log",
"@timestamp" => 2016-11-16T16:45:13.398Z,
"@version" => "1",
"host" => "myhost",
"message" => "28 Oct 2016 19:35:48:Log Message 1\r",
"tags" => []
}
{
"path" => "c:/temp/test.log",
"@timestamp" => 2016-11-16T16:45:13.403Z,
"@version" => "1",
"host" => "myhost",
"message" => "28 Oct 2016 19:35:48:Log Message 2\r",
"tags" => []
}
{
"path" => "c:/temp/test.log",
"@timestamp" => 2016-11-16T16:45:13.404Z,
"@version" => "1",
"host" => "myhost",
"message" => "28 Oct 2016 19:35:48:Log Message 3a\r\n Message 3b\r",
"tags" => [
[0] "multiline"
]
}
Any suggestions would be appreciated.
Using LS 5.0
Thanks,
Sanjiv