S3snssqs - multiline support?

Elastic Stack Logstash
1

Hi

we are trying to read our log usign s3snssqs ; this all works great but the only thing is when we want to detect multiline logs ..

The module doesn't seem to support codec => multiline in order to use a pattern mis-match ..

The filter task of logstash seems to have deprecated the multiline plugin as well, so we are getting our outputs like separate lines instead of one document containing the whole error message.

Help is appreciated

2

You can use a simple pipeline that reads from s3snqsqs and writes to a tcp output, then use a multiline codec on a tcp input for the main pipeline. You will need to maintain event order in the first pipeline, so pipeline.workers must be 1 and you should verify the value of pipeline.ordered.

Do not try to use pipeline-to-pipeline communications for this -- that also ignores the codec.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.