Lumberjack input with multiple files

(Allen Chan) #1

Hi All,

With no stream_identity field in multiline codec, can someone tell me how to handle multiple files coming in through lumberjack protocol? I am using Logstash 1.5 GA

(Mark Walkom) #2

What do you want to do here, multiple stream or multiline, they are different things.

(Allen Chan) #3

I want to do both. I have multiple files that logstash-forwarder is sending to the logstash instance. I have to do multiline on the receiving end to handle stack tracks etc. So far i do not see any intermixing of the log from different files. I see that there are TCP connections equal to how many files i am sending. So i assume that logstash-forwarder is opening a new stream for each file and therefore there is no need for stream_identity anymore.

(system) #4