Hi, with XML files with the following structure:
<?xml version="1.0"?>
<tag id="1234">
...
</tag>
And input config:
codec => multiline {
pattern => "^<\?xml .*\?>"
negate => true
what => "previous"
}
Logstash 5 is not processing the event until the pipeline stops. This also applies when processing multiple files.
To be clear, if I set stdout { rubydebug }
as output, I don't see nothing until I stop the pipeline.
I think these could apply:
github.com/driskell/log-courier/issues/38
github.com/logstash-plugins/logstash-codec-multiline/issues/3
And maybe this:
multiline-not-picking-up-events-immediately/46823/9
However, consider that my files have a newline at the end. I've tried to cat several files:
<?xml version="1.0"?>
<tag id="1234">
...
</tag>
<tag id="5678">
...
</tag>
In that case the last tag is the one which is not being processed until pipeline stops.
Can't figure out how to solve this issue