I have multiple multiline log files of various formats on the same machine. I ship them using one filebeat instance to logstash (deployed on another machine). My main issue is where/how to use the multiline option. Initially I was using the logstash multiline codec: input { beats { port => "5044"…

Parsing multiline logs of various formats

vld January 18, 2017, 12:54pm 2

I made a mistake in my previous post.
I can configure a multiline rule per prospector so I do not need multiple filebeat instances.

Topic		Replies	Views
Distinct LS port per prospector for multiline Beats filebeat	5	791	November 6, 2017
Multiple prospectors not working under filebeat Beats filebeat	6	2212	July 7, 2017
Filebeat with multiline vs. multiline logstash codec Beats filebeat	8	4551	July 5, 2017
How we can handle multiline log at filebeat level? Beats filebeat	2	299	August 27, 2018
Filebeat multiline configuration issue Beats filebeat	2	646	March 8, 2018

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Parsing multiline logs of various formats

Related topics