Multiple Segments logs Collection

Elastic Stack Logstash
1

Hi,
I am a newbie, I am planning to use Logstash for collecting multiple segments logs listening over TCP. Example log format with 23 segments are below:

<181>Jun 29 14:41:37 server1 CM_Passed_Authentications 0000000001 23 0 2015-06-29 14:41:37.881 +05:30 0019694780 5200 NOTICE Passed-Authentication: Authentication succeeded, ConfigVersionId=143,
<181>Jun 29 14:41:37 server1 CM_Passed_Authentications 0000000001 23 1 Device IP Address=10.20.30.40, DestinationIPAddress=50.60.70.80, DestinationPort=1234, UserName=a1-b2-c3-n4,
<181>Jun 29 14:41:37 server1 CM_Passed_Authentications 0000000001 23 2 Protocol=http, RequestLatency=6, NetworkDeviceName=mobile, User-Name=xyz, NAS-IP-Address=1.2.3.4,
.
.
.
<181>Jun 29 14:41:37 server1 CM_Passed_Authentications 0000000001 23 22 ir=profile-name=xyz; },

I want to collect as single log entry by parsing and formatting text with time stamp, other header information and message body.
I checked couple of forums but couldn't find a solution which fits my requirement.

Can someone help me on the same?

Thanks,
Puneet Garg

2

So you are trying to multiline them together? Does this fit if log begins with serve1 CM_Passes_Authentication group them together?

3

Thanks for your reply.
No, That's not the part by which we can group by. It can be group by with below header in current case
<181>Jun 29 14:41:37 server1 CM_Passed_Authentications 0000000001 23

But all info will be changing and coming dynamically for other logs.

Thanks,
Puneet

4

Hi Michael,
I see in my logs I have 0000000001 common. Can I write a codec or filter pattern to check that ID to group logs? If yes, please suggest some sample based on my logs structure.

Thanks,
Puneet Garg

5

Hi Michael,
Just to update I used aggregate filters to achieve my use case.
Thanks for your reply.

Regards,
Puneet Garg