I m using filebeat to parse my logs
I have logs of the following format:
is it possible to send the logs to elasticsearch by adding the fields ID, Date, Message and their values without going through logstash ?
Yes, you'll need to setup a multi line input, see Manage multiline messages | Filebeat Reference [7.12] | Elastic. them add a dissect processor that can parse the message using
\n to represent the line breaks.
thank you for your answer.
i m having a dissect_parsing_error, l think it s because of the \n, do you have any idea where i can find any exemple of dissect using /n ?
I'll have to find it. There was another post on this forum that people discussed it and that's where I saw the
\n. I'll see if I can find it.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.