Logstash Log file creation

In the config file when are trying to read the log file in the log file there are multiline log information is there how can we handle that.
Below is the log file i am giving you .
05 Jun 2018 12:20:59,171 | WARN | TalendMP1555Prod | rg.apache.camel.util.CamelLogger 182 | 161 - org.apache.camel.camel-core - 2.15.4 | A20180605.1200+0100-1215+0100
_73847.xml.gz
05 Jun 2018 12:20:59,208 | WARN | TalendMP1555Prod | rg.apache.camel.util.CamelLogger 182 | 161 - org.apache.camel.camel-core - 2.15.4 | A20180605.1200+0100-1215+0100
_64687.xml.gz
05 Jun 2018 12:20:59,218 | WARN | onfig/MP1451_ANM | rg.apache.camel.util.CamelLogger 161 | 164 - org.apache.camel.camel-ftp - 2.15.4 | Cannot acquire read lock withi
n 20000 millis. Will skip the file: RemoteFile[/home/tmukftp/config/MP1451_ANM/OMCR 4aNETWORK_accClassBts.0100]
05 Jun 2018 12:20:59,401 | WARN | TalendMP1555Prod | rg.apache.camel.util.CamelLogger 182 | 161 - org.apache.camel.camel-core - 2.15.4 | A20180605.1200+0100-1215+0100
_11666.xml.gz
05 Jun 2018 12:20:59,432 | WARN | TalendMP1555Prod | rg.apache.camel.util.CamelLogger 182 | 161 - org.apache.camel.camel-core - 2.15.4 | A20180605.1200+0100-1215+0100
_22678.xml.gz
05 Jun 2018 12:20:59,639 | WARN | TalendMP1555Prod | rg.apache.camel.util.CamelLogger 182 | 161 - org.apache.camel.camel-core - 2.15.4 | A20180605.1200+0100-1215+0100
_93575.xml.gz
05 Jun 2018 12:20:59,652 | WARN | TalendMP1555Prod | rg.apache.camel.util.CamelLogger 182 | 161 - org.apache.camel.camel-core - 2.15.4 | A20180605.1200+0100-1215+0100
_22719.xml.gz
05 Jun 2018 12:20:59,924 | WARN | TalendMP1555Prod | rg.apache.camel.util.CamelLogger 182 | 161 - org.apache.camel.camel-core - 2.15.4 | A20180605.1200+0100-1215+0100
_26336.xml.gz

The bold one in the log file is the multiline.

Has that actually been split into multiple lines? It looks like it just has been wrapped by whatever you've used to look at the log. See https://www.elastic.co/guide/en/logstash/current/multiline.html.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.