Hello, i'm new in logstash and i'm encountering some troubles on building a config that works properly with my needings.
What i want to do is:
-Input files from multiples folders (application logs, so with java exception)
-Use the multiline codec for java exception
-Output files in multiple folder, and i want to output only the raw log, with the multiline modify but without any type of header or additional information
The issue that i'm encountering is that if i use the multiline codec in the input, it works, but i'll have the json_line as default output codec. If i specify a different codec in output, the multiline doesn't work properly.
Instead, if i use the multiline codec in output, it won't work because during the input it will add the logstash header, that cause the multiline malfunction.
Can you help me to solve this? Thanks in advance.
Here my config (now i'm trying with only one folder as input/output):
input {
file {
path => "/folder/*.log"
tags => "host1"
codec => multiline {
pattern => "^(%{MONTHDAY}-%{MONTH}-%{YEAR} %{HOUR}:?%{MINUTE}(?::?%{SECOND})%{SPACE})|(%{TIMESTAMP_ISO8601}%{SPACE})"
negate => true
what => "previous"
}
}
}
filter {
}
output {
if "host1" in [tags]{
file {
path => "/folder/out.txt"
}
}
}
