Logstash - aggregate messages - start with new line

Hi everyone,

I am trying to aggregate events related to the same transaction. The aggregate part works fine, I am able to merge all related events into the same field. But I want each event to be placed at a newline.

See my aggregate filter:

aggregate {
      task_id => "%{thread}"
      code => "map['new_msg'] << '\n'; map['new_msg'] << event.get('message'); event.set('new_msg', map['new_msg'])"
      map_action => "update"
      end_of_task => true
      timeout => 360
    }

This is what my field looks like:

message1\nmessage2\nmessage3\n

This is what I want them to be:

message1
message2
message3

Could anyone please help.

Cheers,
Vincent

Can you explain what you want the event to look like as either JSON or rubydebug output?

Hi @Badger
We want that to be json format. So that when searching from Kibana, we can see the message field is actually multiple line. Rather than one event after another.

Cheers,
Vincent

OK, I'll take that as "no".