Multiline filter in logstash 5.5

Elastic Stack Logstash
1

I am unable to find any example or document giving example of it , this code is from 2.4 version , what would be the equivalent in 5.5 ? I have tried "codec => multiline" but it gives syntax error in the "filter" section , it does work though in the "input" section.

filter (
multiline {
pattern => "%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR}"
negate => true
what => “previous”
}

2

The multiline filter has been deprecated. Use the multiline codec instead. There's an example in the multiline codec documentation.

3

yes I read that document and its was not clear to me how to use the new method , Is the filteration part moved to the input section like below ?

input (
codec => multiline {
pattern => "%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR}"
negate => true
what => “previous”
}

4

Yes.

5

then can you please take a look at my other post since I did exactly that but its creating two indexes and also other issues I have pointed out in my post

https://discuss.elastic.co/t/logstash-5-5-1-index-creation-issue/96828

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.