Logstash - Receive event including line feeds

Elastic Stack Logstash
1

Hi folks,

I try to read an event in Logstash, received via tcp. This event contains line feeds and unfortunately at the logstash filter, where I try to remove the linefeeds via mutate/gsub, I already receive each line one by one as single events. How can I make the logstash input clear, that the entire tcp payload should be treated as one event containing a message with line feeds ?

BR,
Danny

2

The tcp input plugin treats each line as an event. You might be able to combine them using a multiline codec with an auto_flush_interval. Or perhaps you could find a way to use an http input plugin instead.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.