Logstash config
input {
file {
path => "C:/elk/*.log"
start_position => beginning
sincedb_path => "NUL"
codec => multiline {
pattern => "^%{TIMESTAMP_ISO8601:timestamp} "
negate => true
what => previous
auto_flush_interval => 2
}
}
}output {
elasticsearch {
hosts => [ "localhost:9200"]
index => "es-test-logs"
}
stdout { codec => rubydebug }
}
Logs
2021-05-03 13:05:42,669 -INFO [cca.logger.eg]-[User:om-cro1-eg] [Instance: 57261 Step: Fill Application Task: 2078.183536 Subject: Fill New Credit Card Application - CCA-EG-57261] Notes, Attachments & Printing (HS) - Init Document Options (PRE) 2021-05-03 13:05:42,681 -DEBUG[cca.logger.eg]-[User:om-cro1-eg] [Instance: 57261 Step: Fill Application Task: 2078.183536 Subject: Fill New Credit Card Application - CCA-EG-57261] Notes, Attachments & Printing (HS) - Init Document Options (PRE) - Additional Properties: <variable type="NameValuePair[]"> <item type="NameValuePair"> <name type="String"><![CDATA[position]]></name> <value type="String"><![CDATA[CBG-003]]></value> </item> <item type="NameValuePair"> <name type="String"><![CDATA[ProcessInstanceID]]></name> <value type="String"><![CDATA[57261]]></value> </item> </variable> 2021-05-03 13:05:42,111 -INFO [cca.logger.eg]-[User:om-cro1-eg] [Instance: 57261 Step: Fill Application Task: 2078.183536 Subject: Fill New Credit Card Application - CCA-EG-57261] Init Document Options (GSS) - Init - Dpcument Options (PRE)