Hi there,
I try to figure it out by including debug logs.
Here's what I see:
The multiline codec is loaded.
[2018-02-12T13:30:15,390][DEBUG][logstash.codecs.multiline] config LogStash::Codecs::Multiline/@pattern = "<31>%{SYSLOGTIMESTAMP} %{WORD}\\s{5}%{WORD}"
[2018-02-12T13:30:15,390][DEBUG][logstash.codecs.multiline] config LogStash::Codecs::Multiline/@what = "previous"
[2018-02-12T13:30:15,390][DEBUG][logstash.codecs.multiline] config LogStash::Codecs::Multiline/@id = "2b3d2bb0-01f0-4d00-a101-d77830cf103d"
[2018-02-12T13:30:15,390][DEBUG][logstash.codecs.multiline] config LogStash::Codecs::Multiline/@enable_metric = true
[2018-02-12T13:30:15,390][DEBUG][logstash.codecs.multiline] config LogStash::Codecs::Multiline/@negate = false
[2018-02-12T13:30:15,390][DEBUG][logstash.codecs.multiline] config LogStash::Codecs::Multiline/@patterns_dir = []
[2018-02-12T13:30:15,390][DEBUG][logstash.codecs.multiline] config LogStash::Codecs::Multiline/@charset = "UTF-8"
[2018-02-12T13:30:15,390][DEBUG][logstash.codecs.multiline] config LogStash::Codecs::Multiline/@multiline_tag = "multiline"
[2018-02-12T13:30:15,390][DEBUG][logstash.codecs.multiline] config LogStash::Codecs::Multiline/@max_lines = 500
[2018-02-12T13:30:15,391][DEBUG][logstash.codecs.multiline] config LogStash::Codecs::Multiline/@max_bytes = 10485760
The codec takes strings and correctly parses them.
[2018-02-12T13:41:59,025][DEBUG][logstash.codecs.multiline] Multiline {:pattern=>"<31>%{SYSLOGTIMESTAMP} %{WORD}\\s{5}%{WORD}", :text=>"<31>Feb 12 13:41:59 X5_tihvinskaya3 sending Accounting-Request with id 48 to 185.12.28.167:1813", :match=>false, :negate=>false}
[2018-02-12T13:41:59,026][DEBUG][logstash.codecs.multiline] Multiline {:pattern=>"<31>%{SYSLOGTIMESTAMP} %{WORD}\\s{5}%{WORD}", :text=>"<31>Feb 12 13:41:59 X5_tihvinskaya3 Signature = 0xfd4b666fe587c339551d5bb83e47749c", :match=>true, :negate=>false}
[2018-02-12T13:41:59,026][DEBUG][logstash.codecs.multiline] Multiline {:pattern=>"<31>%{SYSLOGTIMESTAMP} %{WORD}\\s{5}%{WORD}", :text=>"<31>Feb 12 13:41:59 X5_tihvinskaya3 Acct-Status-Type = 2", :match=>true, :negate=>false}
[2018-02-12T13:41:59,026][DEBUG][logstash.codecs.multiline] Multiline {:pattern=>"<31>%{SYSLOGTIMESTAMP} %{WORD}\\s{5}%{WORD}", :text=>"<31>Feb 12 13:41:59 X5_tihvinskaya3 Acct-Terminate-Cause = 6", :match=>true, :negate=>false}
[2018-02-12T13:41:59,026][DEBUG][logstash.codecs.multiline] Multiline {:pattern=>"<31>%{SYSLOGTIMESTAMP} %{WORD}\\s{5}%{WORD}", :text=>"<31>Feb 12 13:41:59 X5_tihvinskaya3 NAS-Port-Type = 19", :match=>true, :negate=>false}
[2018-02-12T13:41:59,027][DEBUG][logstash.codecs.multiline] Multiline {:pattern=>"<31>%{SYSLOGTIMESTAMP} %{WORD}\\s{5}%{WORD}", :text=>"<31>Feb 12 13:41:59 X5_tihvinskaya3 Calling-Station-Id = \"9C:35:EB:E4:F0:F5\"", :match=>true, :negate=>false}
[2018-02-12T13:41:59,027][DEBUG][logstash.codecs.multiline] Multiline {:pattern=>"<31>%{SYSLOGTIMESTAMP} %{WORD}\\s{5}%{WORD}", :text=>"<31>Feb 12 13:41:59 X5_tihvinskaya3 Called-Station-Id = \"X5_tihvinskaya3\"", :match=>true, :negate=>false}
But the filter receives separate non-merged events.
[2018-02-12T13:41:59,132][DEBUG][logstash.pipeline ] filter received {"event"=>{"@version"=>"1", "@timestamp"=>2018-02-12T10:41:59.026Z, "host"=>"10.147.99.3", "message"=>"<31>Feb 12 13:41:59 X5_tihvinskaya3 sending Accounting-Request with id 48 to 185.12.28.167:1813"}}
[2018-02-12T13:41:59,132][DEBUG][logstash.pipeline ] filter received {"event"=>{"@version"=>"1", "@timestamp"=>2018-02-12T10:41:59.026Z, "host"=>"10.147.99.3", "message"=>"<31>Feb 12 13:41:59 X5_tihvinskaya3 Signature = 0xfd4b666fe587c339551d5bb83e47749c"}}
[2018-02-12T13:41:59,132][DEBUG][logstash.pipeline ] filter received {"event"=>{"@version"=>"1", "@timestamp"=>2018-02-12T10:41:59.026Z, "host"=>"10.147.99.3", "message"=>"<31>Feb 12 13:41:59 X5_tihvinskaya3 Acct-Status-Type = 2"}}
[2018-02-12T13:41:59,132][DEBUG][logstash.pipeline ] filter received {"event"=>{"@version"=>"1", "@timestamp"=>2018-02-12T10:41:59.027Z, "host"=>"10.147.99.3", "message"=>"<31>Feb 12 13:41:59 X5_tihvinskaya3 Acct-Terminate-Cause = 6"}}
[2018-02-12T13:41:59,132][DEBUG][logstash.pipeline ] filter received {"event"=>{"@version"=>"1", "@timestamp"=>2018-02-12T10:41:59.027Z, "host"=>"10.147.99.3", "message"=>"<31>Feb 12 13:41:59 X5_tihvinskaya3 NAS-Port-Type = 19"}}
[2018-02-12T13:41:59,132][DEBUG][logstash.pipeline ] filter received {"event"=>{"@version"=>"1", "@timestamp"=>2018-02-12T10:41:59.027Z, "host"=>"10.147.99.3", "message"=>"<31>Feb 12 13:41:59 X5_tihvinskaya3 Calling-Station-Id = \"9C:35:EB:E4:F0:F5\""}}
[2018-02-12T13:41:59,132][DEBUG][logstash.pipeline ] filter received {"event"=>{"@version"=>"1", "@timestamp"=>2018-02-12T10:41:59.027Z, "host"=>"10.147.99.3", "message"=>"<31>Feb 12 13:41:59 X5_tihvinskaya3 Called-Station-Id = \"X5_tihvinskaya3\""}}
Has anyone encountered such a codec behavior?