Problem with codec multiline input

Elastic Stack Logstash
1

I want parse my log multiline with the input of Logstash like this :

input {
  beats {
    port => 5443
    if [message] =~ ".*---.*" {
      codec => multiline {
        multiline_tag => "MULTILINE"
        pattern => "^.*\b([0-9]{4}-[0-9]{2}-[0-9]{2})\b.*"
        negate => true
        what => "next"
      }
    }
  }
}

But I take this error

[2018-03-23T10:36:33,035][ERROR][logstash.agent           ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, => at line 186, column 8 (byte 9302) after input {\n  beats {\n    port => 5443\n    if ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:42:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:50:in `compile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:12:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `compile_sources'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:51:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:169:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:40:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:315:in `block in converge_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in `with_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:312:in `block in converge_state'", "org/jruby/RubyArray.java:1734:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:299:in `converge_state'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:166:in `block in converge_state_and_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:141:in `with_pipelines'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:164:in `converge_state_and_update'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:90:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:348:in `block in execute'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:24:in `block in initialize'"]}

I use the 6.2.2 version.
I don't understand what is wrong. Perhaps the codec multiline don't work with the plugin Filebeat ?

2

You always want to perform multiline processing as close to the source in order to ensure ordering of data is correct, so you should use the multiline functionality in Filebeat instead.

3

Is it possible to make a condition in filebeat like I make in the input of Logstash ?

4

You can not have conditional with a plugin specification, so your Logstash config is invalid. Show what the data you are looking to process looks like and someone here may be able to help.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.