Multiline two new lines bewteen messages


(Christian Koller Nielsen) #1

I have a logfile on the form:

aaa
bbb


aaa
bbb


aaa
bbb

and a .conf file:

input {
	file {
		path => "..."
		type => "j4"
		start_position => "beginning"
		codec => multiline {
			pattern => "^[^\r]"
			what => "previous"
			# line not starting with \r belongs to the previous line.
		}
	}	
}
filter {}
output {
	stdout {
		codec => rubydebug
	}
}

I want messages on the form "\raaa\r\n bbb\r"and this works with the following setup if there was just one line shift, but with two line shifts I have trouble figuring out how to get messages on that format. Can someone help?


(Colton) #2

In the filter part of your configuration file you can replace the two line shifts /n/n with a single line shift /n using the gsub command


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.