[SOLVED] Auto_flush_interval not flushing on UDP input

Elastic Stack Logstash
#1

Hi, I´m having problem with multiline codec, my last event is not processed until new one came along.

I know it sounds like I need to configure auto_flush_interval to get rid of the last event, but I set auto_flush_interval to 1 and nothing happens.

Using logstash logstash-codec-multiline (2.0.11) & logstash v.2.3.2.

here my input:

udp {
	host => '0.0.0.0'
	port => '33445'
	codec => multiline {
	  charset => "UTF-8"
	  pattern => "^\t"
	  negate => false
	  what => "previous"
	  auto_flush_interval => 1
	}

thx.

#2

No - multiline auto-flush does not work with the UDP input yet. AFAIK the file input and the beats input are the only input plugins that have been modified to support auto-flush.

It is not possible make auto-flushing work in the codec alone without modifying the input code as well.

The reason why the multiline (or any) codec can't support auto-flush without the input being modified is because the codecs are in-band event generators. This means that the call to decode happens in the input thread's execution context. The input thread calls the codec's decode method with a closure to call back on. Auto-flush is something that occurs out-of-band i.e. in another thread at some time later when the input thread is doing some other work - the auto-flush code/thread does not have a reference to the input to call back on when it has an auto-flush generated event give to Logstash for further processing.

#3