Logstash multiline not working.
2018-08-09 04:15:13,307 Closed connection at 8/9/2018 4:15:13 AM -04:00 <<INFO .Data.AppDbContext [t23]>>
2018-08-09 04:15:13,307 Unexpected error in time zone update <<ERROR UpdateTimeZones [t23]>>
Oracle.ManagedDataAccess.Client.OracleException (0x80004005): ORA-00001: unique constraint (LINK_OD_IREPORT_2.TIME_ZONES_PK) violated
ORA-06512: at "LINK_OD_IREPORT_2.SET_MEETING_TIMEZONE", line 23
ORA-06512: at line 1
at OracleInternal.ServiceObjects.OracleConnectionImpl.VerifyExecution(Int32& cursorId, Boolean bThrowArrayBindRelatedErrors, SqlStatementType sqlStatementType, Int32 arrayBindCount, OracleException& exceptionForArrayBindDML, Boolean& hasMoreRowsInDB, Boolean bFirstIterationDone)
2018-08-09 04:15:13,307 Closed connection at 8/9/2018 4:15:13 AM -04:00 <<INFO .Data.AppDbContext [t23]>>
tried all the combinations of logstash.
input {
file {
path => "C:/Users/ss/Downloads/test6/*"
start_position => "beginning"
codec => multiline {
pattern => "^%{TIMESTAMP_ISO8601} "
negate => true
what => "previous"
}
}
}
output {
stdout { codec => rubydebug }
}
with regex
codec => multiline {
pattern => '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
negate => true
what => "previous"
}
}
output:
{
"message" => "2018-08-09 04:15:13,307 Closed connection at 8/9/2018 4:15:13 AM -04:00 <<INFO Data.AppDbContext [t23]>>\r",
"path" => "C:/Users/ss/Downloads/test8/test1.LOG",
"@version" => "1",
"@timestamp" => 2018-08-15T22:59:06.089Z
}