Parsing data from multiple lines

Elastic Stack Logstash
1

Hi All,

I have a log file which has a big chunk of log like below. Using the GREEDYDATA pattern I am able to parse only till

00000000-00000000 6260 0C100005 CnHttpRequest.cpp:5268 Sending Header

I am looking to grab the entire text till the end. I am not sure how this can be accomplished. Appreciate any help on this.

  • 2016-09-26T19:52:38.595 Trc 60022 INFO 00000000-00000000 6260 0C100005 CnHttpRequest.cpp:5268 Sending Header
  • [GET /Postpaid/network_sms.asp HTTP/1.1
  • User-Agent: Mozilla/4.0 (compatible; Telera _ND_C 8.1.410.36)
  • Accept: /
  • Host: localhost
  • Cookie: $Version=0; ASPSESSIONIDSARBBASQ=EBBAMFHACKOPKKKCCINLLHEG; $Path=/
  • X-GEN-Session-ID: 380EA899-F926-4A6A-F2A6-C81983EB358D
  • ]
2

So are you looking to capture multiple lines into one event?

3

Yes, I want to capture data under single event.

4

Use the multiline codec:

https://www.elastic.co/guide/en/logstash/6.5/plugins-codecs-multiline.html

You will need a clear end indicator

1 Like
5

Great that helped a lot. Another quick question can we have multiple pattern to determine multi line?

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.