Solution for multiple patterns for multiline configuration

Elastic Stack Logstash
1

In the multiline documentation the setting "pattern" is a string and it's not possible to put an array of patterns, but I have a really hard logfile to parse and I need to do something similar.

I have two type of logs in the SAME FILE and sometimes they are on multiple lines as following :

2016-02-16 17:25:35,241 foo foo foo foo
        foo foo foo foo
        foo foo foo foo
        foo foo foo foo
        foo foo foo foo
Wed Feb 17 09:59:28 CET 2016 foo foo foo foo
        foo foo foo foo
        foo foo foo foo
        foo foo foo foo

I tried to do two multiline or something as following but without sucess :

 multiline{
      pattern => "((^%{TIMESTAMP_ISO8601}%{SPACE})|(^%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{WORD} %{YEAR}))"
      what    => "previous"
      negate  => true
    }

How can I do a multiline codec matching my logs on multiple lines ?

Thanks

2

There's probably a small error in your expression. I don't see why an expression on the form ^(expr1|expr2) wouldn't work.

1 Like
3

@magnusbaeck Yes thank you, I changed my expression and it's working now :slightly_smiling: