Hello,
Do you know if there is a possibility to use multiple codecs in the same file input?
I need to manage "multiline" and "plain" codecs for the same file.
Currently, here is my configuration (I have anonymized data):
input{
# ASYNCHRONOUS LOGS
file{
# Ces deux lignes permettent de ré analyser tous les fichiers du répertoire
start_position => beginning
#sincedb_path => "/dev/null"
# #######
# Chemin du ou des fichiers de logs à analyser
path => ["List of files to analyze"]
# On exclut les fichiers d'erreurs
exclude => "*_ERR.*"
# Aggrégation de champs permettant d' identifier plus précisément les documents
add_field => {"application" => "myapp"
"environment" => "test"
}
# Permet de gérer les retours à ligne vide de certains logs asynchrones
codec => multiline{
pattern => "^%{YEAR}[./-]%{MONTHNUM}[./-]%{MONTHDAY} %{TIME}"
negate => true
what => previous
}
# Type de fichier analysé
type => "async"
}
}
My need is to have the following:
codec => multiline{
pattern => "^%{YEAR}[./-]%{MONTHNUM}[./-]%{MONTHDAY} %{TIME}"
negate => true
what => previous
}
codec => plain{
charset => "UTF-8"
}
If you have any idea of how can i do that...
Thank you for your feedback