Skip to content

Instantly share code, notes, and snippets.

@pisceanfoot

pisceanfoot/logstash_input_multiline.conf

Created August 23, 2016 07:02
Show Gist options
  • Save pisceanfoot/96daad4ddae8ccec86db6262f98121af to your computer and use it in GitHub Desktop.
Save pisceanfoot/96daad4ddae8ccec86db6262f98121af to your computer and use it in GitHub Desktop.
Download ZIP
logstash multiline with auto flush
Raw
logstash_input_multiline.conf
input {
file {
path => "/Users/leo/Documents/Workspace/dev/messagesub/log.log"
type => "normal_log"
codec => multiline {
pattern => "^(?!\[\d{4})"
what => "previous"
negate => false
auto_flush_interval => 5
}
}
#beats {
# port => 5044
#}
}
@pisceanfoot
Copy link
Author

pisceanfoot commented Aug 23, 2016 •
edited
Loading

all matched line not start with [\d{4}, will send to previous line.

test case below

[2016-08-23 11:03:20,004] [CRITICAL] mainJob - please enter command7
ksdf
--============
12
    12
  333333
sdf
    esdffdsf
  sdfsfdf
--===
==-
!@#$%^&*
&^

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment