Multiline input codec not working (php stacktrace)

[paul_m (paul)]

Hi folks,

I'm running logstash 6.4 with a gelf login using the multiline codec, and I can't get it to recognise the pattern. Ideally the pattern I want to attach to the previous line is ^(#|StackStrace), but I'm failing with even just ^#. The source is docker logs streaming, so I can't do multiline beforehand.

input {
    gelf {
        port => 12201
        tags => ['gelf']
        codec => multiline {
            pattern => "^#"
            negate => false
            what => previous
            auto_flush_interval => 1
        }
    }
}

Example stack trace:

[2019-08-15 07:45:33] api[].ERROR: Directus\Exception\UnauthorizedException: Unauthorized request in /var/www/myapp/src/helpers/app.php:268
Stack trace:
#0 /var/www/myapp/vendor/slim/slim/Slim/App.php(530): Directus\{closure}
#1 /var/www/myapp/src/core/Directus/Application/Http/Middleware/CorsMiddleware.php(66): Slim\App->__invoke
#2 [internal function]: Directus\Application\Http\Middleware\CorsMiddleware->__invoke
#3 /var/www/myapp/vendor/slim/slim/Slim/DeferredCallable.php(43): call_user_func_array
#4 [internal function]: Slim\DeferredCallable->__invoke
#5 /var/www/myapp/vendor/slim/slim/Slim/MiddlewareAwareTrait.php(70): call_user_func
#6 /var/www/myapp/vendor/slim/slim/Slim/MiddlewareAwareTrait.php(117): Slim\App->Slim\{closure}
#7 /var/www/myapp/vendor/slim/slim/Slim/App.php(405): Slim\App->callMiddlewareStack
#8 /var/www/myapp/vendor/slim/slim/Slim/App.php(313): Slim\App->process
#9 /var/www/myapp/src/core/Directus/Application/Application.php(161): Slim\App->run
#10 /var/www/myapp/public/index.php(5): Directus\Application\Application->run [] []

I've tried various regexes and flipping negate in various ways. The lines are never multilined when viewed in Kibana.

Does anyone have an idea as to what I'm doing wrong?

Thanks,

Paul

https://www.elastic.co/guide/en/logstash/6.4/plugins-codecs-multiline.html