Regarding Multiline codec

Elastic Stack Logstash
1

Hi,
If I am using the multine codec on an input which handles multiple input sources can it be configured to handle the various multiline formats of each source? This is desirable behaviour to avoid pattern matching against every in-flight event.

I've seen the patterns_dir option but this doesn't seem to allow for matching multiple patterns against an input?

Regards,
David

2

You shoudl be able to use set of multiline filters that you include conditionally based on... something.

filter {
  if [message] =~ /some expression/ {
    multiline {
      ...
    }
  } else if ... {
    multiline {
      ...
    }
  }
}

Can't you place the multiline handling closer to the origin where you know the exact format?

3

Yes, but we're not ready for that step yet.