Placing Mutliline file into 1 document

[Elk_huh (Brian)]

I have a file that looks like this and I keep getting the first 7 lines as individual documents and the last one its own document. How do i get it so all of these come back as 1 document

I have so far

filter{
kv {}
}

input file

startTime:34534
accountId:78
format:CEF
checksum:grtgt45hfgh
endTime:45645645
configId:1234
|==|
CEF=0 helloworld=234 32313 name=ob age=90

[Badger]

What input are you using?

[Elk_huh (Brian)]

input {
file {
path => "/tmp/logs/*.log"
codec => multiline {
pattern => "^CEF"
negate => true
what => "previous"
}
}

[Badger]

OK, so the codec is looking for any lines that match ^CEF. Lines that do not match are joined to the previous event. A line that matches CEF starts a new event.

If you want to consume the entire file as a single event then use a pattern that never matches and flush using a timeout

codec => multiline {
    pattern => "^Spalanzani"
    what => "previous" 
    negate => true 
    auto_flush_interval => 2
}

If you have a repeating pattern of lines you also have the option of

codec => multiline {
    pattern => "^CEF"
    what => "next" 
    negate => true 
    auto_flush_interval => 2
}