Truncating multi line

Elastic Stack Beats
1

Hi, I would like to know how to truncate log message.
Below is the example:
2018/02/22 00:26:36.233 | ERROR [TaskExecutor-master-11369-ProcessTask [8879082013622]] [ActionNode] Error executing
2018/02/22 00:26:36.233 | java.lang.NullPointerException
2018/02/22 00:26:36.233 | at XXX

If I use the multiline example I'm able to get the above 3 lines as one event, but the issue is that the content of the event is like the following:
ERROR [TaskExecutor-master-11369-ProcessTask [8879082013622]] [ActionNode] Error executing
2018/02/22 00:26:36.233 | java.lang.NullPointerException
2018/02/22 00:26:36.233 | at XXX

How can I truncate the timestamp from the message, so that I can get the following:
ERROR [TaskExecutor-master-11369-ProcessTask [8879082013622]] [ActionNode] Error executing
java.lang.NullPointerException
at XXX

Thank you.

2

Filebeat is focused on log shipping. For log processing have a look at Logstash or the Ingest Pipeline in Elasticsearch. It seems you have a more complex case here so Logstash is probably the way to go.

3

Thanks for the response. At least I know now, that filebeat is not the right place to accomplish the requirement.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.