Hi folks,
I'm running logstash 6.4 with a gelf login using the multiline codec, and I can't get it to recognise the pattern. Ideally the pattern I want to attach to the previous line is ^(#|StackStrace)
, but I'm failing with even just ^#
. The source is docker logs streaming, so I can't do multiline beforehand.
input {
gelf {
port => 12201
tags => ['gelf']
codec => multiline {
pattern => "^#"
negate => false
what => previous
auto_flush_interval => 1
}
}
}
Example stack trace:
[2019-08-15 07:45:33] api[].ERROR: Directus\Exception\UnauthorizedException: Unauthorized request in /var/www/myapp/src/helpers/app.php:268
Stack trace:
#0 /var/www/myapp/vendor/slim/slim/Slim/App.php(530): Directus\{closure}
#1 /var/www/myapp/src/core/Directus/Application/Http/Middleware/CorsMiddleware.php(66): Slim\App->__invoke
#2 [internal function]: Directus\Application\Http\Middleware\CorsMiddleware->__invoke
#3 /var/www/myapp/vendor/slim/slim/Slim/DeferredCallable.php(43): call_user_func_array
#4 [internal function]: Slim\DeferredCallable->__invoke
#5 /var/www/myapp/vendor/slim/slim/Slim/MiddlewareAwareTrait.php(70): call_user_func
#6 /var/www/myapp/vendor/slim/slim/Slim/MiddlewareAwareTrait.php(117): Slim\App->Slim\{closure}
#7 /var/www/myapp/vendor/slim/slim/Slim/App.php(405): Slim\App->callMiddlewareStack
#8 /var/www/myapp/vendor/slim/slim/Slim/App.php(313): Slim\App->process
#9 /var/www/myapp/src/core/Directus/Application/Application.php(161): Slim\App->run
#10 /var/www/myapp/public/index.php(5): Directus\Application\Application->run [] []
I've tried various regexes and flipping negate in various ways. The lines are never multilined when viewed in Kibana.
Does anyone have an idea as to what I'm doing wrong?
Thanks,
Paul
https://www.elastic.co/guide/en/logstash/6.4/plugins-codecs-multiline.html