Logstash multiline codec ignores last line of log file

Elastic Stack Logstash
1

My logstash config has a mix of multiline and single line events that are being parsed correctly, reading a log file. I'm using multiline codec as follows:

input {
    file {
    .....
    .....
    codec => multiline {
        pattern => ......
        what => "previous"
        }
    }
}

filter {
    ......
}

output {
    file {
    codec => json_lines {}
    }
}

However, I also need to parse the line at the end of log file starting with 'Thank you for using said app.' But due to multiline codec, Logstash does not parse the last line of the log file. How can i correct this? I cannot modify the log file generator to add a delimiter (\n) when ending the log file.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.