Hello There,
Find the sample log at the end.
I am using the multiline codec in logstash to combine the lines without timestamp with tasks and then using split to get the following fields
timestamp, processid, user, roleName (eg A) , taskName(eg Include OS-specific variables. TAGS: []) etc
Now, for the following line(s) include TAGS: [X], the roleName should be the roleName prior to the current include i.e roleName should be A and the taskName should be
include TAGS: [X]. Likewise for include TAGS[XX], the roleName should be B.
After the split all the events are having the same timestamps. The order of events seem to be disrupted eg role A comes after include etc with the result the roleNames for all the include events are displayed either A or B.
Let me know the right approach that can be followed for this.
Note: Am using the worker count as 1
Sample Log
2017-12-19 05:50:12,014 p=2271 u=xxxx | tasks:
A : Include OS-specific variables. TAGS: []
A : Include OS-specific variables for Fedora. TAGS: []
A : Include version-specific variables for Ubuntu. TAGS: []
A : Define java_packages. TAGS: []
include TAGS: [X]
include TAGS: [Y]
include TAGS: [Z]
B: Task B desc1
B: Task B desc 2
include TAGS[XX]
include TAGS[YY]
Thanks and Regards ,
Bhavani
Hello There,
Can someone throw light on this. Is the order of events changed after a split?
Thanks,
Bhavani