Logstash- transfrom multiple log lines to one line

Elastic Stack Logstash
1

I have a situation where I am getting logs from forwarder in the below format:

timestamp <uniquerID> entry: ProcessAPI{AddEmployee} :hostname
timestamp <uniquerID> send: UserAPI{ValidateUser} :hostname
timestamp <uniquerID> receive: UserAPI{ValidateUser} :hostname
timestamp <uniquerID> send: AccountAPI{ValidateAccount} :hostname
timestamp <uniquerID> receive: AccountAPI{ValidateAccount} :hostname
timestamp <uniquerID> exit: ProcessAPI{AddEmployee} :hostname

I want to combine these log line to a single line like below format:

timestamp <uniquerID> Exit:ProcessAPI{AddEmployee}:hostname | UserAPI{ValidateUser}:hostname | AccountAPI{ValidateAccount}:hostname

Is there a way in Logstash to do this.?

Update: Each log line has associated parent service name in the source field as below:

@Source: ProcessAPI{AddEmployee}
@Message : timestamp send: UserAPI{ValidateUser} :hostname

2

Look at the multiline codec.

3

Hi
Is multline is threadsafe.I am seeing from the Logstash info stating that multiline is not thread safe.

We need a solid solution to concat these either using multiline,merge or aggregate

4

The current multiline codec documentation says nothing about thread safety.

5

HI
Is multiline will be achieved for where we have many logs like this coming from different services

6

I tried Multiline codec , but its combining the whole logs to an array.

The scenario here is that I have same types of logs coming from many services in bulk.

Example :
Service A calling --> Service B

So logs for both service A as well as service B will be shipped to logstash simultaneously.

How would I combine logs of service A as single line and logs for Service B as another single line.