Multiline codec and JDBC

Elastic Stack Logstash
1

Hello everybody,
I'm trying to use the multiline codec with the ids of rows from a table (Database).
i've an input plugin with JDBC which give me some rows with same id (because of the SQL query).
I would like to process these rows by block which have the same id because i want to create a document in ElasticSearch not for each row but for each id.
Thanks in advance for yours answers.

2

Maybe if you can provide an example of your config and data we can help.

3

Hello warkolm,
Yes I can give more details about my problem. So, here is an exemple of my .conf file with Logstash :

input {
	jdbc {
            jdbc_connection_string => "jdbc:oracle:thin:@..."
            jdbc_user => "..."
    	    jdbc_password => "..."
            jdbc_driver_library => "ojdbc7.jar"
            jdbc_driver_class => "Java::oracle.jdbc.driver.OracleDriver"
            statement_filepath => "query.sql"
	}
}

filter {
...
}

output {
    elasticsearch {
        index => "..."
        hosts => "..."
        action => "..."
        document_type => "..."
        document_id => "%{id}"
    }
}

Because of relations in my database, the query give me some rows with the same identifiant (it's an exemple):
id1, data1, data2
id1, data1', data2'
id1, data1'', data2''
id2, data1, data2
id2, data1', data2'

Each row is an event but I would like process the rows with the same identifiant together (by block). In my mind, I can't use a pattern because I look for an exact value.