We have a mail gateway based on Postfix, and we want to get these logs into Elastic.
For our product, our MSP that helps us with it has a logstash based integration that is also merges the mutliline log of postfix to one document.
Now at the moment we have no logstash and are not planning to install it, so we are trying to get this working without Logstash. This gets us to some different questsions, and I hope I can post them all in one topic:
- Is there any way in Elastic with simple ingest pipelines and without Logstashto merge these multiline logs into one document at ingest time? I think I read about ways to do this after ingest by reindexing to a new index with merged documents, but it looks like this is not currently possible at ingest time.
- Are there plans in the future tu be able to merge such multiline logs with an agent-based ingest pipline and without Logstash?
- If both questions are answered with "no", we might have to start using Logstash. But can somebody tell me about the "future" of this product? As far as I read and heard Logstash gets more and more replaced by agent functionality - does this mean that Logstash will not be needed anymore in a near or far future? Or will logstash stay a helpfull ingest method for the foreseeable future?
Thanks in Advance for your input
Best regards,
Tobias