Logstash multiline pattern

hi guys,

i have a log file which consists of below pattern , i need to treat all lines of this log file as 1 aggregate event.file will close after 30 minutes and then new log will start..which pattern will work here... i am trying to use if line ends with new line feed , then merge next line with previous line ...but how to tell logstash that file has ended

codec => multiline {
pattern => ".*\r"
negate => false
what => "next"

log format

DEBUG:root:some data
DEBUG:root:some data
DEBUG:root:error occured
method finished

INFO:root:some data
method complete

Use a pattern that will never match, and use a timeout

codec => {
    pattern => "^Spalanzani"
    negate => true
    what => next
    auto_flush_interval => 3700

its not getting last line into multiline... message aggregates all line except last ...

Is there a newline at the end of the last line?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.