Multiline codec is not breaking messages correctly

Afternoon,

I'm having some issues with the multiline codec config and it adding events to the previous message so not being very helpful.

in logstash I have the following input definition

syslog {
        id => "input-syslog"
        port => 5140
        type => "syslog"
        codec => multiline {
            patterns_dir => [ "/etc/logstash/conf.d/patterns.d" ]
            pattern => "(^%{SYSLOGBASE})|(^%{SYSLOGBASE_RFC5424})|(Udp data)"
            negate => true
            what => "previous"
        }
        add_field => { "[logstash][host][name]" => "${LOGSTASH_HOSTNAME}" }
}

This seems to be working for some systems that throw a stack trace via syslog occasionally and where RFC5424 messages are sent (they always appear as a single event), but it doesn't appear to like the %{SYSLOGBASE} messages.

So I'm getting those types of messages rolled up

For example:

<134> 12/31/2019:15:01:32 GMT LB-TST-VPX01 0-PPE-0 : default EVENT MONITORUP 17181 0 : Monitor DBSMonServiceBinding_log-collectors-syslog:514_(tcp-default)(#syslog-internal_service-log-collectors-syslog
<134> 12/31/2019:15:01:40 GMT LB-TST-VPX01 0-PPE-0 : default GUI CMD_EXECUTED 17184 0 : User sparkblaze - Remote_ip 192.168.100.6 - Command "show ns config" - Status "Success"

Have I missed something obvious that I can't see at the moment?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.