Log message encoding of \n for multiline output

Elastic Stack Beats
1

Hello All-

In my messages, some of the log messages actually have \n in the log output itself along with other random characters like XML tags. Is there a way to encode \n in file beat before shipping to log stash so the grok process doesn't split this into multiple messages? I am able to parse this as mutiline and grok the input in log stash. But the issue is embedded \n in the log output.

I was looking at this setting in file beat:

  # Configure the file encoding for reading files with international characters
  # following the W3C recommendation for HTML5 (http://www.w3.org/TR/encoding).
  # Some sample encodings:
  #   plain, utf-8, utf-16be-bom, utf-16be, utf-16le, big5, gb18030, gbk,
  #    hz-gb-2312, euc-kr, euc-jp, iso-2022-jp, shift-jis, ...
  #encoding: plain

[DEBUG] 2020-09-23 08:50:36,248[ajp-nio-9031-exec-9]  CUSTOMIZATION - [ThingWatchListTag][fetchWatchListDetailsForUser][ThingWatchListTag getWatchListDetailsForUser() ] olio key : \n com.grk.id.wsc.olio.value.olioKeyVO@2d51e371\n
[
  actorID=<null>\n
  actorType=FTE\n
  asn=<null>\n
  filterType=DealerNo\n
  giin=<null>\n
  cIPSearch=<null>\n
  pagination=<null>
  thingIDType=<null>\n
  strtIndx=<null>\n
  realTimeFlag=true\n
  requestParams={}\n
  uid=<null>\n
  uidType=<null>\n
  userLoginID=jjones\n
  referenceIDTable={}\n
  callerName=<null>\n
  callerPhone=<null>\n
  wirn=<null>\n
  pega=<null>\n
  rdChoice=<null>\n
  reqTypeSAT=<null>\n
  reqDateSAT=<null>\n
]

Thanks,
Kevin

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.