I think that this is the final configuration:
input {
syslog {
type => "docker-dev-support"
host => "0.0.0.0"
port => 6000
codec => multiline {
pattern => "^<%{NUMBER}>%{NUMBER} %{TIMESTAMP_ISO8601} %{NOTSPACE} %{NOTSPACE} %{NUMBER} - - (%{TIMESTAMP_ISO8601}|%{IPORHOST}|\[%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR}\])"
negate => true
what => "previous"
}
}
}
filter {
if [type] == "docker-dev-support" {
grok {
patterns_dir => ["/etc/logstash/patterns/"]
match => { "message" => "%{DOCKERSYSLOG}" }
}
if "_grokparsefailure_sysloginput" in [tags] {
mutate {
remove_tag => [ "_grokparsefailure_sysloginput" ]
}
}
mutate {
remove_field => [ "message" ]
}
}
}
output {
if [type] == "docker-dev-support" {
elasticsearch {
action => "index"
codec => "plain"
hosts => [ "http://localhost:9200" ]
index => "logstash-docker-test-dev-support-%{+YYYY.MM.dd}"
}
}
}
I need to check if the logstash wait a new closing line to store the last rows processed into the multiline pipeline.