Consider this log file structure: patA1 .*? patA2 .*? patA3 ... (many lines here) patB1 .*? patB2 .*? patB3 patB1 .*? patB2 .*? patB3 In the above, consider patXY to be different regex patterns, i.e. the first line above could be grokked via something like this: grok { match => { "message"…

Multiline grok of consecutive events of the same type with joining

Badger March 12, 2019, 8:26pm 3

That seems like a good approach provided the input file is small enough that you can handle it as a single multiline event.

Topic		Replies	Views
Specific GROK filter for multi-line Postgresql log Logstash	13	5240	July 6, 2017
How to manage multiline events based on a random field Logstash	24	5686	July 6, 2017
Processing multiline events from filebeat Logstash	5	365	May 2, 2018
Parsing multiline logs in Logstash Logstash	4	2744	July 20, 2017
GROK Multiline Newby Logstash	7	1235	July 6, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Multiline grok of consecutive events of the same type with joining

Related topics