Can I use a multiline codec in the filter? I've more than 10k+ files of 3 different patterns logs pattern on S3 bucket that will be fetched using input plugin. One log pattern requires a multiline codec before start parsing them. I want to use it like filter { if [message] =~ /this regex/ { us…

If you need to make the use a codec conditional on the contents you could use a tcp input and output to connect two pipelines and conditionally send the events to the second pipeline, which could use a multiline codec. You would need event order to be preserved, so you have to set pipeline.workers …

Discuss the Elastic Stack

Multiline codec in filter

Elastic Stack Logstash

Badger November 24, 2020, 7:47pm 10

There is an example here.

1 Like

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.