Logstash multiline CSV

Elastic Stack Logstash
1

Hi,

I recently switched from Filebeat to Logstash, but my multiline config pattern is not working anymore.

My config file:

input
{
  file
  {
    path => [ "D:/temp/*test*.csv" ]
    start_position => "beginning"
	
	codec => multiline
		{
			pattern => "^\t|^Take the following|^\","
			negate => "false"
			what => "next"
		}
  }
}

The CSV file with 2 entries:

"Name","Description","WhenChanged"
".","Take the following actions:
	Set audit severity level to 'Do not audit'
	and Blind carbon copy(Bcc) the message to 'temp@temp'
","8/12/2021 1:46:46 AM"
"geheim","If the message:
	Includes these words in the message subject or body: 'temp1' or 'temp2' or 'temp3'
Take the following actions:
	Set audit severity level to 'Do not audit'
	and Blind carbon copy(Bcc) the message to 'temp@temp.com'
","1/18/2022 1:56:15 AM"

My goal is to get the 3 comma separated fields. What is the best way to archive this?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.