Multiline in logstash

Elastic Stack Logstash
1

HI

Having a file like

2017-12-14 12:45:44.570 [http-nio-9000-exec-9] DEBUG o.s.w.f.CommonsRequestLoggingFilter.beforeRequest(47) - Before request [uri=/gateway/api/v1/fitment-processes/02;client=0:0:0:0:0:0:0:1;user=tcsens]
2017-12-14 12:45:44.578 [http-nio-9000-exec-9] DEBUG o.s.w.f.CommonsRequestLoggingFilter.afterRequest(55) - After request [uri=/gateway/api/v1/fitment-processes/02;client=0:0:0:0:0:0:0:1;user=tcsens;payload={
    "header": {
        "sourceRefNo": "12341232017121200006",
        "SPID": "1234",
        "LOCID": "123",
        "requestType": "02",
        "timestamp": "2017-03-03T10:02:03.215+08:00"
    },
    "body": {
        "customerProfile": {
          "name": "Kent",
          "email" : "kent@rbtsb.com",
          "idType": "1",
          "idNumber": "1234567890",
          "mobileCountryCode": "MYS",
          "mobileNumber": "01234567890",
          "address1": "jalan 123",
          "nationality": "MYS",
          "pdpaConsent": true,
          "marketingConsent": true
        },
        "vehicleOwnerProfile": {
          "vehicleRegNo": "WWW123",
          "vehicleType": "1",
          "vehicleMake": "123",
          "vehicleModel": "Lambo",
          "vehicleManufactorYear": "2017",
          "vehicleRegCountry": "MYS",
          "noOfTyre": "4",
          "axleCount": "2"
        },
        "sourceAccNo": "655967826649773895863967885245",
        "fee": "10.00",
        "gst": "0.00",
        "remark": ""
    }
}
]
2017-12-14 12:45:45.066 [http-nio-9000-exec-10] DEBUG o.s.w.f.CommonsRequestLoggingFilter.beforeRequest(47) - Before request [uri=/gateway/api/v1/fitment-processes/02;client=0:0:0:0:0:0:0:1;user=tcsens]
2017-12-14 12:45:45.075 [http-nio-9000-exec-10] DEBUG o.s.w.f.CommonsRequestLoggingFilter.afterRequest(55) - After request [uri=/gateway/api/v1/fitment-processes/02;client=0:0:0:0:0:0:0:1;user=tcsens;payload={
"header": {
    "sourceRefNo": "12341232017121200006",
    "SPID": "1234",
    "LOCID": "123",
    "requestType": "02",
    "timestamp": "2017-03-03T10:02:03.215+08:00"
},
"body": {
    "customerProfile": {
      "name": "Kent",
      "email" : "kent@rbtsb.com",
      "idType": "1",
      "idNumber": "1234567890",
      "mobileCountryCode": "MYS",
      "mobileNumber": "01234567890",
      "address1": "jalan 123",
      "nationality": "MYS",
      "pdpaConsent": true,
      "marketingConsent": true
    },
    "vehicleOwnerProfile": {
      "vehicleRegNo": "WWW123",
      "vehicleType": "1",
      "vehicleMake": "123",
      "vehicleModel": "Lambo",
      "vehicleManufactorYear": "2017",
      "vehicleRegCountry": "MYS",
      "noOfTyre": "4",
      "axleCount": "2"
    },
    "sourceAccNo": "655967826649773895863967885245",
    "fee": "10.00",
    "gst": "0.00",
    "remark": ""
}
}
]

Want to merge the lines into one line
output:

[uri=/gateway/api/v1/fitment-processes/02;client=0:0:0:0:0:0:0:1;user=tcsens;payload={"header": { "sourceRefNo": "12341232017121200006", "SPID": "1234", "LOCID": "123", "requestType": "02", "timestamp": "2017-03-03T10:02:03.215+08:00" }, "body": { "customerProfile": { "name": "Kent", "email" : "kent@rbtsb.com", "idType": "1", "idNumber": "1234567890", "mobileCountryCode": "MYS", "mobileNumber": "01234567890", "address1": "jalan 123", "nationality": "MYS", "pdpaConsent": true, "marketingConsent": true }, "vehicleOwnerProfile": { "vehicleRegNo": "WWW123", "vehicleType": "1", "vehicleMake": "123", "vehicleModel": "Lambo", "vehicleManufactorYear": "2017", "vehicleRegCountry": "MYS", "noOfTyre": "4", "axleCount": "2" }, "sourceAccNo": "655967826649773895863967885245", "fee": "10.00", "gst": "0.00", "remark": "" } } ]

After the string After request from the uri till end need to be on same line

i am using fallowing code but not able achieve please help on this

input {
  file {
    path => "d:/rfid_logstash/maven.log"
    codec => multiline {
      # Grok pattern names are valid! :)
      pattern => "^After\W"
      what => "previous"
      
    }
	start_position => "beginning"
	sincedb_path => "/dev/null"
  }
}
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.