Hi there,
The microtik sends syslog messages of one RADIUS event in several rows
|26|0.099429|10.147.99.3|10.147.99.9|Syslog|137|DAEMON.DEBUG: Feb 8 18:35:18 X5_tihvinskaya3 sending Accounting-Request with id 34 to 185.12.28.167:1813|
|27|0.099581|10.147.99.3|10.147.99.9|Syslog|128|DAEMON.DEBUG: Feb 8 18:35:18 X5_tihvinskaya3 Signature = 0xff4233fa4532473b33ce5c459047da4b|
|28|0.099694|10.147.99.3|10.147.99.9|Syslog|102|DAEMON.DEBUG: Feb 8 18:35:18 X5_tihvinskaya3 Acct-Status-Type = 1|
|29|0.099808|10.147.99.3|10.147.99.9|Syslog|100|DAEMON.DEBUG: Feb 8 18:35:18 X5_tihvinskaya3 NAS-Port-Type = 19|
|30|0.099933|10.147.99.3|10.147.99.9|Syslog|122|DAEMON.DEBUG: Feb 8 18:35:18 X5_tihvinskaya3 Calling-Station-Id = "A8:5C:2C:3B:81:19"|
|31|0.100057|10.147.99.3|10.147.99.9|Syslog|119|DAEMON.DEBUG: Feb 8 18:35:18 X5_tihvinskaya3 Called-Station-Id = "X5_tihvinskaya3"|
|32|0.100186|10.147.99.3|10.147.99.9|Syslog|114|DAEMON.DEBUG: Feb 8 18:35:18 X5_tihvinskaya3 NAS-Port-Id = "Perekrestok_Free"|
|33|0.100311|10.147.99.3|10.147.99.9|Syslog|117|DAEMON.DEBUG: Feb 8 18:35:18 X5_tihvinskaya3 User-Name = "790350925182@4917.com"|
|34|0.100424|10.147.99.3|10.147.99.9|Syslog|103|DAEMON.DEBUG: Feb 8 18:35:18 X5_tihvinskaya3 NAS-Port = 2153775114|
|35|0.100549|10.147.99.3|10.147.99.9|Syslog|110|DAEMON.DEBUG: Feb 8 18:35:18 X5_tihvinskaya3 Acct-Session-Id = "8060000a"|
|36|0.100681|10.147.99.3|10.147.99.9|Syslog|114|DAEMON.DEBUG: Feb 8 18:35:18 X5_tihvinskaya3 Framed-IP-Address = 172.16.0.248|
|37|0.100802|10.147.99.3|10.147.99.9|Syslog|107|DAEMON.DEBUG: Feb 8 18:35:18 X5_tihvinskaya3 MT-Host-IP = 172.16.0.248|
|38|0.100939|10.147.99.3|10.147.99.9|Syslog|110|DAEMON.DEBUG: Feb 8 18:35:18 X5_tihvinskaya3 Event-Timestamp = 1518104118|
|39|0.101056|10.147.99.3|10.147.99.9|Syslog|116|DAEMON.DEBUG: Feb 8 18:35:18 X5_tihvinskaya3 NAS-Identifier = "X5_tihvinskaya3"|
|40|0.101189|10.147.99.3|10.147.99.9|Syslog|101|DAEMON.DEBUG: Feb 8 18:35:18 X5_tihvinskaya3 Acct-Delay-Time = 0|
|41|0.101302|10.147.99.3|10.147.99.9|Syslog|97|DAEMON.DEBUG: Feb 8 18:35:18 X5_tihvinskaya3 MT-Realm = 0x31|
|42|0.101443|10.147.99.3|10.147.99.9|Syslog|111|DAEMON.DEBUG: Feb 8 18:35:18 X5_tihvinskaya3 NAS-IP-Address = 10.191.101.2|
I need to combine them in one line at the input for parsing
I use next Pipeline
input {
udp {
port => 8514
codec => multiline {
pattern => "DAEMON.DEBUG: %{SYSLOGTIMESTAMP} %{WORD}\s{5}%{WORD}"
what => "previous"
}
}
}
filter {
}
output {
stdout{
codec => rubydebug
}
}
If in line 5 there are spaces, then connect to the previous one
But on the output I see all the same separate lines as on the input, only with additional information
2018-02-09T13:48:34.557Z 10.147.99.3 <31>Feb 9 16:48:34 X5_tihvinskaya3 sending Accounting-Request with id 35 to 185.12.28.167:1813
2018-02-09T13:48:34.558Z 10.147.99.3 <31>Feb 9 16:48:34 X5_tihvinskaya3 Acct-Status-Type = 1
2018-02-09T13:48:34.558Z 10.147.99.3 <31>Feb 9 16:48:34 X5_tihvinskaya3 NAS-Port-Type = 19
2018-02-09T13:48:34.558Z 10.147.99.3 <31>Feb 9 16:48:34 X5_tihvinskaya3 Calling-Station-Id = "9C:35:EB:E4:F0:F5"
2018-02-09T13:48:34.558Z 10.147.99.3 <31>Feb 9 16:48:34 X5_tihvinskaya3 Called-Station-Id = "X5_tihvinskaya3"
2018-02-09T13:48:34.558Z 10.147.99.3 <31>Feb 9 16:48:34 X5_tihvinskaya3 NAS-Port-Id = "Perekrestok_Free"
2018-02-09T13:48:34.558Z 10.147.99.3 <31>Feb 9 16:48:34 X5_tihvinskaya3 User-Name = "790350925182@4917.com"
2018-02-09T13:48:34.559Z 10.147.99.3 <31>Feb 9 16:48:34 X5_tihvinskaya3 Event-Timestamp = 1518184114
2018-02-09T13:48:34.559Z 10.147.99.3 <31>Feb 9 16:48:34 X5_tihvinskaya3 NAS-Identifier = "X5_tihvinskaya3"
2018-02-09T13:48:34.559Z 10.147.99.3 <31>Feb 9 16:48:34 X5_tihvinskaya3 Acct-Delay-Time = 0
2018-02-09T13:48:34.559Z 10.147.99.3 <31>Feb 9 16:48:34 X5_tihvinskaya3 MT-Realm = 0x31
2018-02-09T13:48:34.559Z 10.147.99.3 <31>Feb 9 16:48:34 X5_tihvinskaya3 NAS-IP-Address = 10.191.101.2
What am I doing wrong?