Parsing Failed for multiline starts with dd MMM yyyy HH:mm:ss,SSS
Sample log : 06 May 2018 18:25:01,021 Some Multiline Text
Below configuration is used
input {
file {
path => "/Some/Loactions/*.log"
type => "api_access"
codec => multiline {
pattern => "^{TIMESTAMP_ISO8601:timestamp} "
negate => true
what => "previous"
}
date {
"match" => [ "timestamp", "dd MMM yyyy HH:mm:ss,SSS" ]
target => "@timestamp"
}
}
output {
elasticsearch { hosts => ["localhost:9200"] }
stdout { codec => rubydebug }
}