Hi,
I'm working with a log with the following structure (fragment):
2018-01-30 18:14:10.466554
(0x03000000:PCDataField ):folio = '201711231427280265' (CHARACTER)
(0x03000000:PCDataField ):idProceso = '7' (CHARACTER)
(0x03000000:PCDataField ):idSubproceso = '101' (CHARACTER)
(0x03000000:PCDataField ):idSubetapa = '273' (CHARACTER)
(0x03000000:PCDataField ):idSnapshot = '2064.c76a4df4-7e11-4c0a-9a04-f305faaef4d6' (CHARACTER)
(0x01000000:Folder ):parametros = (
(0x01000000:Folder):parametro = (
(0x03000000:PCDataField):nombre = 'REPROCESO' (CHARACTER)
(0x01000000:Folder ):valores = (
(0x03000000:PCDataField):valor = '2' (CHARACTER)
)
)
(0x01000000:Folder):parametro = (
(0x03000000:PCDataField):nombre = 'ID_INSTANCIA' (CHARACTER)
(0x01000000:Folder ):valores = (
(0x03000000:PCDataField):valor = '16649' (CHARACTER)
)
)....
each time a new event is generated a similar block is added to the log, I filter this new event using a codec multiline like this:
input {
file {
path => "/home/test.log"
start_position => "beginning"
codec => multiline {
pattern => "^%{TIMESTAMP_ISO8601} "
negate => true
what => "previous"
}
}
}
Then when i try to get the fields (folio, idProceso, etc), using the following filter:
grok{
match => { "message" => "\W\w+:\w+\W:%{DATA:linea}\(" }
}
It only applies the filter to the first line of the multiline, for example it only returns: folio = '201711231427280265'
I don't know, how to change the filter to apply it again to the remaining lines of the log?
Thanks for your help