Max Lines Multiline Codec


(Samir) #1

Hello EveryOne,

I have a problem with one log. This log contains 600 lines and I need it to be store in ElasticSearch as a single document.
So I use the multiline codec but it puts me : "Multiline codec max lines reached".
I know that the default value of max lines is 500 but I don't know how change this.

I try max_lines : 600
max_lines => 600
multiline.max_lines : 600

But It doesn't work. So If you can help me !
Thanks !


(Samir) #2

It's good I found the right expression :

codec => multiline {
pattern => "^%{TIME}"
negate => true
what => previous
max_lines => 1000
}


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.