# Process VMWare ESXi syslog with multiline events **URL:** \ **Category:** Logstash\ **Created:** [May 16, 2018, 12:10pm UTC](https://discuss.elastic.co/t/process-vmware-esxi-syslog-with-multiline-events/132117 "2018-05-16T12:10:07Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Kris\_Boeckx](https://avatars.discourse-cdn.com/v4/letter/k/439d5e/32.png) [@Kris\_Boeckx](https://discuss.elastic.co/u/Kris_Boeckx)\ **Post date:** [May 16, 2018, 12:10pm UTC](https://discuss.elastic.co/t/process-vmware-esxi-syslog-with-multiline-events/132117/1 "2018-05-16T12:10:07Z")
Hi, I'm trying to process syslog events that are send by an vmware ESXi server with logstash. This is working fine except multiline events . Below an example of the raw data that is sent via syslog: \<166\>2018-05-16T08:57:41.409Z host.domain.somewhere Hostd: info hostd[B885B70] [Originator@6876 sub=Hbrsvc] Replicator: UnregisterListener triggered for config VM 749 \<166\>2018-05-16T08:57:41.410Z host.domain.somewhere Hostd: info hostd[B4C2B70] [Originator@6876 sub=Vcsvc.VMotionSrc (5610940323356380425)] CompleteOp: Vmotion task succeeded with result: (vim.host.VMotionManager.SrcVMotionResult) { \<166\>2018-05-16T08:57:41.410Z host.domain.somewhere Hostd: --\> vmDowntime = 4072, \<166\>2018-05-16T08:57:41.410Z host.domain.somewhere Hostd: --\> vmPrecopyStunTime = 650021, \<166\>2018-05-16T08:57:41.410Z host.domain.somewhere Hostd: --\> vmPrecopyBandwidth = 726706228 \<166\>2018-05-16T08:57:41.410Z host.domain.somewhere Hostd: --\> } \<163\>2018-05-16T08:57:41.410Z host.domain.somewhere Hostd: error hostd[B4C2B70] [Originator@6876 sub=VigorStatsProvider(179323808).GuestStats(749)] VigorCallback received fault: Disconnected from virtual machine. \<163\>2018-05-16T08:57:41.410Z host.domain.somewhere Hostd: --\> Remote disconnected \<163\>2018-05-16T08:57:41.410Z host.domain.somewhere Hostd: --\> \<166\>2018-05-16T08:57:41.411Z host.domain.somewhere Fdm: info fdm[3840B70] [Originator@6876 sub=Invt opID=SWI-5a4d466d] [InventoryManagerImpl::RemoveVmLocked] vm /vmfs/volumes/ab8d5fbc-81dbb0f9/XXXXXXXXX/XXXXXXXXX.vmx (not protected) removed from local host; on 0 hosts Each multiline item contains "--\>" and can be matched with this grok filter: %{SYSLOG5424PRI}%{TIMESTAMP\_ISO8601:SyslogTimestamp} %{IPORHOST:Hostname} %{PROG:AppName}: --\>%{GREEDYDATA:Message} How can I combine the multiline items so it becomes 1 event ? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 16, 2018, 2:14pm UTC](https://discuss.elastic.co/t/process-vmware-esxi-syslog-with-multiline-events/132117/2 "2018-05-16T14:14:22Z")
> [@Kris\_Boeckx](#): > > How can I combine the multiline items so it becomes 1 event ? This will combine them. I don't think you will like the result though 🙂 ``` stdin { codec => multiline { pattern => "-->" negate => false what => "previous" auto_flush_interval => 3 } } ``` ---
**Author:** ![Kris\_Boeckx](https://avatars.discourse-cdn.com/v4/letter/k/439d5e/32.png) [@Kris\_Boeckx](https://discuss.elastic.co/u/Kris_Boeckx)\ **Post date:** [May 16, 2018, 2:51pm UTC](https://discuss.elastic.co/t/process-vmware-esxi-syslog-with-multiline-events/132117/3 "2018-05-16T14:51:50Z")
No other solution ? Can I use filebeat for this ? Do I need to parse the lines into structured data (json) ? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 16, 2018, 3:37pm UTC](https://discuss.elastic.co/t/process-vmware-esxi-syslog-with-multiline-events/132117/4 "2018-05-16T15:37:22Z")
> [@Kris\_Boeckx](#): > > Can I use filebeat for this ? > > Do I need to parse the lines into structured data (json) ? filebeat can combine multiple lines into a single event in the same way that logstash can. I would stick to a logstash codec if it works. I would then mutate+gsub to remove all the "\<166\>2018-05-16T08:57:41.410Z host.domain.somewhere Hostd: --\>" junk, since it is repeated information. Then parse out whatever fields are useful to you. ---
**Author:** ![Kris\_Boeckx](https://avatars.discourse-cdn.com/v4/letter/k/439d5e/32.png) [@Kris\_Boeckx](https://discuss.elastic.co/u/Kris_Boeckx)\ **Post date:** [May 17, 2018, 8:30am UTC](https://discuss.elastic.co/t/process-vmware-esxi-syslog-with-multiline-events/132117/5 "2018-05-17T08:30:42Z")
Ok, when a mutiline item occures, a "multiline" tag is added so I can check for that. The multiline event is parsed into this: "message" =\> "\<166\>2018-05-16T08:57:41.410Z host.domain.somewhere Hostd: info hostd[B4C2B70] [Originator@6876 sub=Vcsvc.VMotionSrc (56109403233 56380425)] CompleteOp: Vmotion task succeeded with result: (vim.host.VMotionManager.SrcVMotionResult) {\r\n\<166\>2018-05-16T08:57:41.410Z host.domain.s omewhere Hostd: --\> vmDowntime = 4072,\r\n\<166\>2018-05-16T08:57:41.410Z host.domain.somewhere Hostd: --\> vmPrecopyStunTime = 650021,\r\n\<166\>2018-05-1 6T08:57:41.410Z host.domain.somewhere Hostd: --\> vmPrecopyBandwidth = 726706228\r\n\<166\>2018-05-16T08:57:41.410Z host.domain.somewhere Hostd: --\> }\r" How can I strip out all **except** the first occurence of "\<166\>2018-05-16T08:57:41.410Z host.domain.s omewhere Hostd:" ? The pattern for this is "%{SYSLOG5424PRI}%{TIMESTAMP\_ISO8601:SyslogTimestamp} %{IPORHOST:Hostname} %{PROG:AppName}:" ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 17, 2018, 12:17pm UTC](https://discuss.elastic.co/t/process-vmware-esxi-syslog-with-multiline-events/132117/6 "2018-05-17T12:17:49Z")
> [@Kris\_Boeckx](#): > > How can I strip out all except the first occurence of "\<166\>2018-05-16T08:57:41.410Z host.domain.s > > omewhere Hostd:" ? ``` mutate { gsub => ["message", "<[0-9]+>.*: -->", "" ] } ``` You might also want to ``` mutate { gsub => [ "message", " ", "" ] } ``` ---
**Author:** ![Kris\_Boeckx](https://avatars.discourse-cdn.com/v4/letter/k/439d5e/32.png) [@Kris\_Boeckx](https://discuss.elastic.co/u/Kris_Boeckx)\ **Post date:** [May 17, 2018, 1:59pm UTC](https://discuss.elastic.co/t/process-vmware-esxi-syslog-with-multiline-events/132117/7 "2018-05-17T13:59:17Z")
I ended up with this filter: ``` filter { if "multiline" in [tags] { grok { break_on_match => true match => [ "message", "%{SYSLOG5424PRI}%{TIMESTAMP_ISO8601:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{SYSLOGPROG:syslog_program}: %{GREEDYDATA:syslog_message}" ] } mutate { gsub => ["syslog_message", "<[0-9]+>.* -->", "" ] gsub => ["syslog_message", "\r", ""] } } } ``` Thanks for your help ! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 14, 2018, 1:59pm UTC](https://discuss.elastic.co/t/process-vmware-esxi-syslog-with-multiline-events/132117/8 "2018-06-14T13:59:20Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.