Logging Multiline events using logforwarder and log stash

(vinay gupta) #1


I want to transfer Java logs using log forwarder on the application servers.

What will be the best way to log Java exceptions as single event as log-forwarder doesn't support Multiline input codec?

Can I use "Multiline Filter" in the logstash that will receive events from logforwarder to treat them as a single event and associate them with the timestamp received in the previous event?


(Magnus B├Ąck) #2

Yes, you can use the multiline filter for this. You'll want to make sure the stream_identity parameter is correctly set to a value that allows the filter to pair up the different streams of log data and concatenate lines that go together. The default value will probably do.

(vinay gupta) #3

Thanks. That was quick.

(system) #4