Parsing multiple lines CSV with filebeat & Logstash

Elastic Stack Beats
1

Hey Guys,

I have a CSV file that looks like the attached image.

Capture
Capture.JPG1772×572 317 KB

I want to send this csv file to logstash.
The configuration is working well except that the whole file is being sent as a single message. filebeat is not splitting the lines.

I saw the multiline option in the docs. But I'm not sure on what to use for my file.
What would you recommend? should i match LF (end of line char? ) or how can I proceed?

Here's the configuration now:
filebeat.prospectors:

- type: log
  enabled: true
  paths:
     - /var/capture/test/*.csv
  tags: ["iclick-tcplog"]

  multiline.pattern: ',\d+,[^\",]+$'
  multiline.negate: true
  multiline.match: before
2

A better understanding of multiline shows that i didn't need it at all. problem solved by omitting all the multiline options.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.