Logstash - aggregate messages - start with new line

Elastic Stack Logstash
1

Hi everyone,

I am trying to aggregate events related to the same transaction. The aggregate part works fine, I am able to merge all related events into the same field. But I want each event to be placed at a newline.

See my aggregate filter:

aggregate {
      task_id => "%{thread}"
      code => "map['new_msg'] << '\n'; map['new_msg'] << event.get('message'); event.set('new_msg', map['new_msg'])"
      map_action => "update"
      end_of_task => true
      timeout => 360
    }

This is what my field looks like:

message1\nmessage2\nmessage3\n

This is what I want them to be:

message1
message2
message3

Could anyone please help.

Cheers,
Vincent

2

Can you explain what you want the event to look like as either JSON or rubydebug output?

3

Hi @Badger
We want that to be json format. So that when searching from Kibana, we can see the message field is actually multiple line. Rather than one event after another.

Cheers,
Vincent

4

OK, I'll take that as "no".

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.