Mixed line types JSON and Plain Text in the same file with multiline

Elastic Stack Logstash
1

Hello,

I've got log files that can contain plain text lines from a Java application and JSON lines.

To complicate matters the plain text lines can be multiline , for example a Java stack trace, so I'm using the multiline codec in the input configuration. This doesn't play nice with the JSON lines as they match the multiline codec's pattern.

I was wondering how I can handle this in logstash?

I've tried:

  • conditionals in the input, but this doesn't work and isn't designed to work.
  • multiple pipeline to pipeline communication with an first pipeline detecting { and distributing to a JSON or Plain text pipeline, but I cannot use the multiline codec on the second pipeline, obviously as event could appear out of order.

Anyone have any other ideas I could test out?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.