Multiline not processing event until pipeline stops

Hi, with XML files with the following structure:

<?xml version="1.0"?>
<tag id="1234">
  ...
</tag>

And input config:

codec => multiline {
      pattern => "^<\?xml .*\?>"
      negate => true
      what => "previous"
    }

Logstash 5 is not processing the event until the pipeline stops. This also applies when processing multiple files.
To be clear, if I set stdout { rubydebug } as output, I don't see nothing until I stop the pipeline.

I think these could apply:

github.com/driskell/log-courier/issues/38
github.com/logstash-plugins/logstash-codec-multiline/issues/3

And maybe this:

multiline-not-picking-up-events-immediately/46823/9

However, consider that my files have a newline at the end. I've tried to cat several files:

<?xml version="1.0"?>
<tag id="1234">
  ...
</tag>
<tag id="5678">
  ...
</tag>

In that case the last tag is the one which is not being processed until pipeline stops.

Can't figure out how to solve this issue :expressionless:

Little update: I've noticed that using the multiline filter with Logstash 2.4.0 everything works fine.
However, trying the same multiline filter with Logstash 5.5.0 I receive a config error:

reason=>"Couldn't find any filter plugin named 'multiline'. Are you sure this is correct? Trying to load the multiline filter plugin resulted in this error: LoadError

I encountered exactly the same error.
Does anyone have any idea on how to solve this?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.