Regarding multiple message field


(Amit) #1

I have use html file path to create index but file content is not coming in single message field.It is breaking in different message fields in hits.how should i get it in single message field.
Json for html file is like this:

{
"took":4,
"timed_out":false,
"_shards":{
"total":5,
"successful":5,
"failed":0
},
"hits":{
"total":21,
"max_score":1.0,
"hits":[
{
"_index":"htmlfilesindex192",
"_type":"EdibleOil",
"_id":"AVwghhPDHU_4M72rXbeQ",
"_score":1.0,
"_source":{
"path":"C:\ELK-Stack\amit_singh\html_content.json",
"@timestamp":"2017-05-19T11:43:54.327Z",
"@version":"1",
"host":"CRISILDSK5958",
"message":"{"mesage":"Note: Demand growth remained weak during H1 of 2015-16 .Except for east,demand growth was muted in all the regions. For FY16,the pick-up in growth is expected to be limited due to poor monsoon and weak infrastructure spending in most regions. Hence, we revise growth forecast for FY16 to 3.5-4%. As a result of weak demand and new capacity additions, utilisation levels and prices are expected to remain at FY15 levels. Operating profit margins are likely to improve slightly .The chapter shall be updated before March 07, 2016.\r",
"type":"EdibleOil",
"tags":[
]
}
},
{
"_index":"htmlfilesindex192",
"_type":"EdibleOil",
"_id":"AVwghhPDHU_4M72rXbeS",
"_score":1.0,
"_source":{
"path":"C:\ELK-Stack\amit_singh\html_content.json",
"@timestamp":"2017-05-19T11:43:54.585Z",
"@version":"1",
"host":"CRISILDSK5958",
"message":"Demand growth patchy, government spending pick up key to growth revival\r",
"type":"EdibleOil",
"tags":[
]
}
},

I want all content in single hit and message field


(Magnus B├Ąck) #2

Logstash's file input reads the input line by line. You'll have to use a multiline codec to join the lines into a single event. This can be tricky to get right.


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.