Multi_line codec vs filter


(Chris Marino) #1

I'm using Logstash to index files where separate lines relate to the same event, thus I want to use multi_line.

What is the difference between using a multi_line codec in my input plugin versus using the multi_line filter plugin?

Is there a use case where one is better than the other?

Thanks,
Chris


(system) #2