June 8, 2018, 2:41pm
I need to parse a multiline event and,
as suggested in the docs, I'm leaving to Filebeat the handling of the multiline:
- type: log
pattern: '^Multiline event header$'
Now, according to this config, I'd expect to see a multiline
message in Kibana. Instead, the parsed logfile is still split in multiple single-line messages. Which input/filter/output config do I need to set in Logstash to get a multiline message?
This is not a logstash question. If filebeat is merging mulitple lines then logstash will pass them onto elasticsearch and thence Kibana.
That pattern says that if the line matches the pattern (anchored at both ends), then it should be merged with the preceding line. Otherwise lines are fed as is.
documentation for false+after: Consecutive lines that match the pattern are appended to the previous line that doesn’t match.
June 8, 2018, 2:57pm
You're right. I have corrected it in
Now it works. Thank you.
To the mods: please feel free to move this question to
the Filebeat category.
July 6, 2018, 2:57pm
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.