logstash 中多行合并

Posted 2020-10-19 BigBao的博客

这里我之前是在input里面配置的多行合并，合并语法为：

input {
        beats {
          type => beats
          port => 7001
          codec => multiline {
            patterns_dir => ["/data/package/logstash/vendor/bundle/jruby/1.9/gems/logstash-patterns-core-2.0.2/patterns"]
            pattern => ".*#ELK#.*"
            what => "previous"
            negate => true

        }
        }
}

 

这里我们也可以再filter里面使用multiline插件来合并多行

logstash 在filter里设置多行合并 
filter {
  multiline {
    pattern => ".*TRACE.*"
    what => "previous"
  }
}

https://groups.google.com/forum/#!topic/logstash-users/7LFyeIQMmEM