one log file is this way
line1
line2
line3
When givenn as input to logstash with grok match "message":".*$", the log file is entered into ES as
"message":"line1\nline2\nline3"
Each \n is considered new line and can see lines seperated in GUI
But in ES, as number of lines are huge, log file is entered into es as multiple fragments each holding max possible lines (i.e 500 which may be ES default max lines)
Please suggest a mutate or ruby block which will manipulate log file into message as comma seperated lines instead of \n
**EXPECTED OUTPUT:**
"message":"line1,line2,line3"
So you want that a file with multiple lines be as a single document in ES separated by commas?
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.