CODEWITHSUNDEEP
filterlogstashmultiline
RdrgPorto
RdrgPorto

Reputation: 21

How to process Logstash Multiline entry?

I have a generated log file that has the following pattern :

=======================================================
Debut du traitement vcc_0pg.sh - HISTORISATION DES FICHIERS LOGS le 15/07/05 00:30
Historisation des fichiers de log OK
=======================================================

And my config file is:

filter {

    multiline{
        pattern => "^Debut"
        what => "previous"
        negate=> true
    }

    if [type] == "prueba"{
      grok{
        match => ['message',"%{GREEDYDATA:content}"]
         }

      mutate {
        replace => [ "message", "%{content}" ]
        remove_field => ["content"]
      }

    }

if [message] == "^=" {
    drop { }
   }  
}

I would like to obtain part 2,it contains two lines (multiline),moreover I would like to remove part 1 and part 3. :

1: =======================================================
2: Debut du traitement vcc_0pg.sh - HISTORISATION DES FICHIERS LOGS le 15/07/05 00:30
    Historisation des fichiers de log OK
3: =======================================================

Upvotes: 1

Views: 143

Answers (1)

RdrgPorto
RdrgPorto

Reputation: 21

I resolved it with:

if [type] == "debut" {

    if ([message] =~ "^=") {
        drop {}
    }

    multiline {
        pattern => "^Debut"
        what => "previous"
        negate=> "true"
    }

   if ("Debut" in [message])
        {
          grok {
          match => [ "message", "Debut du traitement %{GREEDYDATA:file} -" ]
          }
         grok {
          match => [ "message", "%{DATE_EU:date} %{HOUR:hour}:%{MINUTE:minute}" ]
          }
         mutate {
           add_field => { "logdate" => "%{date} %{hour}:%{minute}" }

            }
         date {
          locale => "fr"
          timezone => "Europe/Paris"
          match => ["logdate", "yy/MM/dd HH:mm"]
          target => "logdate"
          }
         mutate
        {
           remove_field => [ "date" ]
           remove_field => [ "hour" ]
           remove_field => [ "minute" ]
        }
    }

  }

Upvotes: 1

Related Questions