Ok, i figured out that it is perfectly possible to test multiline messages with logstash filter verifier.
To do so, the codec json has to be used instead of line or json_line.
One thing that drove me crazy is that if you use the --sockets flag (what you very likely want to speed up the tests) you cannot have more than one multiline test case per test file.
In this case you currently have two options:
Don't use the --sockets flag (which will result in slow tests)
Put each multiline test case in a separate file.
Maybe I should make a bugreport, but I am not sure if it is a bug or intended behaviour.
i struggle to test multiline events. Could you please share a sample test file ?
mine is:
"codec": "json",
"input": [
"{"message": "13:59:17,601 WARN [org.apache.cxf.phase.PhaseInterceptorChain] Interceptor for {http://proofofidentity.documents.fr/}ProofOfIdentityWebService has thrown exception, unwinding now\nmiddleware.exceptions.TechnicalException: Some constraints\n\t The field value has value \n\n\tat java.lang.Thread.run(Thread.java:745)"}"
],
ouput is :
Testcase failed, continuing with the rest: Expected 1 event(s), got XX instead.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.