Logging Multiline events using logforwarder and log stash

Elastic Stack Logstash
1

Hi

I want to transfer Java logs using log forwarder on the application servers.

What will be the best way to log Java exceptions as single event as log-forwarder doesn't support Multiline input codec?

Can I use "Multiline Filter" in the logstash that will receive events from logforwarder to treat them as a single event and associate them with the timestamp received in the previous event?

Thanks

2

Yes, you can use the multiline filter for this. You'll want to make sure the stream_identity parameter is correctly set to a value that allows the filter to pair up the different streams of log data and concatenate lines that go together. The default value will probably do.

3

Thanks. That was quick.