logstash-codec-json works expects single JSON messages, so i need to extract them first when reading file containing JSON lines (JSON messages delimited by \n) using logstash-codec-multiline plugin.
It works in most cases but problem occurs in about 0,3% of all processed log lines.
Both strings from example in my previous post apply to single log line:
- first is just a single line from log file
- second is related "message" value.
As you can see beginning of data in "message" value is missing comparing to log line. I mean that part:
{"Validation::Ms":1,"Authentication::Ms":4,"Profile::XId::FindProfile::Ms":2,"SearchQuery::
I've marked difference in bold in first post.
Do you think it's multiline problem ?
I've suggested NFS after reading this:
https://discuss.elastic.co/t/logstash-vs-nfs-null-characters/25918
Thanks !