Logstash XML Parsing Using multiline


(Samnik60) #1

I am trying to parse an xml file as shown below

http://pastebin.com/SgX5gYY2

i tried to use the multiline filter of logstash as

multiline {
  pattern => ".*</LogMessage>"
  negate => true
  what => "previous"
}

It is not giving me correct parsing but if i use

multiline {
  pattern => ".*</LogMessage>"
  negate => true
  what => "next"
}

it parses perfectly , Now according to my understanding if the pattern matches then it need to be configured to be included to "previous" but specifying "next" works, i am misunderstanding something here ?

Thanks,
sam


(system) #2