The contents of LogStash's conf file looks like this: input { beats { port => 5044 } file { path => "/usr/share/logstash/iway_logs/*" start_position => "beginning" sincedb_path => "/dev/null" #ignore_older => 0 codec => multiline { pattern => "^\[%{NOTSPACE:t…

[image] srii: if [message] =~ /^\s*$/ { drop { } } Your multiline expression will append blank lines to the previous line with a timestamp. /^\s*$/ matches a blank line within a multiline message. If you just want to drop messages that only contain whitespace then try /\A\s*\Z/.

Discuss the Elastic Stack

LogStash Conf | Drop Empty Lines

Elastic Stack Logstash

srii (Srii) December 20, 2022, 6:17pm 3

@RudyStolds Thanks but the filter to drop empty lines (I tried a similar filter) works already at the cost of messed up multiline parsing...

Topic		Replies	Views
Logstahs behavior about empty lines Logstash	9	6649	September 28, 2017
Logstash Drop Lines Logstash	3	902	February 12, 2019
Unable to drop lines using drop filter of logstash Logstash	12	1245	June 6, 2019
Multiline conf file to parse log file to elasticsearch Logstash	5	1881	July 6, 2017
Logstash multiline pattern : continuous newline Logstash	9	2017	March 22, 2018

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

LogStash Conf | Drop Empty Lines

Related topics