Multiple codecs? running multiline codec during filter?

Elastic Stack Logstash
1

I have log entries coming in as a JSON payload. I'm using a json codec, then splitting the entries in a filter. My JSON looks something like this:

payload = { "date": "...", "source": "...", "entries": ["line1", "line2", " multiline line2"] }

I need multiline support, but it's a codec. As far as I can tell I need it as a filter.

Is there a way to parse JSON and then run multiline as codecs? Is there another way to get multiline support?

2

No, an input can only have one codec. You can use a multiline filter and then a json filter though.

3

So multiline can be done at the filter stage? I guess I just can't find the documentation of a multiline filter, all I can find is the multiline codec. Maybe it's not a plugin but somehow native? Or a codec can be used as a filter?

4

Sorry, what I meant to say was "You can use a multiline codec and then a json filter"

5

Ah.

That won't work, because my multilines are coming in as a list inside the JSON.

I see there was a multiline filter that was deprecated in 2.4 or so.

I'll probably end up rewriting or adapting the logs upstream, I think.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.