Multiline - pattern repeats in content

Elastic Stack Logstash
1

Hello, I'm using Logstash to parse some incident reports and attempting to use the multiline codec with my CSV files. The problem I'm running into is that in certain fields, the pattern that I'm using to determine a new event is repeated in the text. This is breaking the flow and causing errors:

<CSV::MalformedCSVError: Illegal quoting in line 1.>

Each event starts with an ID, like this:

IM00103411

...and here is my configuration file:

codec => multiline {
			pattern => "^IM00"
			negate => "true"
			what => "previous"

Any suggestions on how I can avoid tripping up on this copy and breaking out of the multiline magic too early? Thanks.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.