Logs on two lines

Elastic Stack Logstash
1

Hi,

I am trying to get logs whose are on two different lines :

[2019-06-18T06:57:32.032Z] [org.kie.api.internal.utils.tydhiks] [main] [141] [INFO ]
Adding Service org.drools.core.concurrent.EEEeeF

In my logstash I tried :

 grok {
      patterns_dir => "/u01/app/elk-config/logstash/patterns"
          match => ["message", "(?m)\[(?<timestamp>%{TIMESTAMP_ISO8601})\]\[%{DATA:servlet}\]\[%{WORD:branch}\]\[%{DATA:PID}\]\[%{DATA:level}\]%{DATA:log_message}"]
     }

but it does not take the second line in the same json and I've got a "_grokparsefailure" on my field log_message.

I tried :

    filter {
        mutate {
           gsub => ["message", "\s\n*", ""]
       }
    }

but it does not change anything
Do you have an idea ?
Thanks

2

Are both lines part of the same event?

3

Yes it’s the same event

4

DATA does not match newlines. Try

match => ["message", "^\[%{TIMESTAMP_ISO8601:timestamp}\] \[%{DATA:servlet}\] \[%{WORD:branch}\] \[%{DATA:PID}\] \[%{DATA:level}\]%{GREEDYDATA:log_message}"]
5

No It's the same issue my log message is split .

6

Hi,

Have a look at this. Sounds similar to what you are trying to achieve
https://www.elastic.co/guide/en/logstash/current/multiline.html#_timestamps

1 Like
7

Thanks, it helped me ! My events was not good

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.