Using input field for pattern matching


(Dheeraj Uppalapati) #1

Hi,

Is it possible to use an input field to match the pattern via multiline/grok filter. For example, following doesn't work :

 multiline {
   pattern => [log_pattern]
   negate => true
   what => "previous"
   source => "data"
}

Use case:
I am trying to setup a logstash multiline parser with inputs from different applications. I'd like to make the applications set a pattern field which will be used for matching.


(Magnus B├Ąck) #2

Theoretically,

multiline {
  pattern => "%{log_pattern}"
  ...
}

could be made to work for a multiline filter, but then every single event would need to have a log_pattern field. Except for a few plugins (like multiline), Logstash doesn't keep any state between events.


(system) #3