Parsing logs filebeat

Elastic Stack Beats
1

Hello,
I m using filebeat to parse my logs
I have logs of the following format:
ID: xxx
Date: xxx
Message: xxx
is it possible to send the logs to elasticsearch by adding the fields ID, Date, Message and their values ​​without going through logstash ?

Thank you

2

Yes, you'll need to setup a multi line input, see Manage multiline messages | Filebeat Reference [7.12] | Elastic. them add a dissect processor that can parse the message using \n to represent the line breaks.

1 Like
3

Hello,
thank you for your answer.
i m having a dissect_parsing_error, l think it s because of the \n, do you have any idea where i can find any exemple of dissect using /n ?
Thank you

4

I'll have to find it. There was another post on this forum that people discussed it and that's where I saw the \n. I'll see if I can find it.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.