Logstash config to get multiline messages

Elastic Stack Logstash
1

I need to parse a multiline event and, as suggested in the docs, I'm leaving to Filebeat the handling of the multiline:

filebeat.prospectors:
- type: log
  paths:
    - /path/to/logfiletoparse.log
  multiline:
    pattern: '^Multiline event header$'
    negate: 'false'
    match: 'after'

Now, according to this config, I'd expect to see a multiline message in Kibana. Instead, the parsed logfile is still split in multiple single-line messages. Which input/filter/output config do I need to set in Logstash to get a multiline message?

2

This is not a logstash question. If filebeat is merging mulitple lines then logstash will pass them onto elasticsearch and thence Kibana.

That pattern says that if the line matches the pattern (anchored at both ends), then it should be merged with the preceding line. Otherwise lines are fed as is.

Note the documentation for false+after: Consecutive lines that match the pattern are appended to the previous line that doesn’t match.

1 Like
3

You're right. I have corrected it in

negate: 'true'

Now it works. Thank you.

To the mods: please feel free to move this question to the Filebeat category.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.