Multiline filter in logstash 5.5


(sami) #1

I am unable to find any example or document giving example of it , this code is from 2.4 version , what would be the equivalent in 5.5 ? I have tried "codec => multiline" but it gives syntax error in the "filter" section , it does work though in the "input" section.

filter (
multiline {
pattern => "%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR}"
negate => true
what => “previous”
}


(Magnus Bäck) #2

The multiline filter has been deprecated. Use the multiline codec instead. There's an example in the multiline codec documentation.


(sami) #3

yes I read that document and its was not clear to me how to use the new method , Is the filteration part moved to the input section like below ?

input (
codec => multiline {
pattern => "%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR}"
negate => true
what => “previous”
}


(Magnus Bäck) #4

Yes.


(sami) #5

then can you please take a look at my other post since I did exactly that but its creating two indexes and also other issues I have pointed out in my post

https://discuss.elastic.co/t/logstash-5-5-1-index-creation-issue/96828


(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.