I have log format like this
<<<\n
Accept:application/json, text/javascript, */*; q=0.01\r\n
Content-Type:application/x-www-form-urlencoded; charset=UTF-8\r\n
Origin:https://discuss.elastic.co\r\n
Referer:https://discuss.elastic.co/c/logstash\r\n
\r\n
<soap><a><b></b></a></soap>
>>>\n
and my logstash.conf
input {
s3 {
codec => multiline {
pattern => "<<<\n"
negate => true
what => "previous"
}
}
}
output {
elasticsearch {
host => "192.168.99.100:9200"
index => "tt"
}
}
With this config, I always lose last one log.
for example, I have 450 logs but only 449 logs in Elasticsearch.
How could I solve this problem ?
Or I should not use multiline codec ?
English is not my mother language, if any word is offensive, please tell me.
Thank you