Rails production.log has two empty lines in between each event. My multiline filter with pattern "\n\n" is not matching and I know for sure I have two newlines.
Here is the filter I tried which isn't working with a typical rails production.log:
multiline
{ type => "rails_prod_log" pattern => "\n\n" negate => "true" what => "previous" }
The following works but isn't quite what I want:
multiline
{ type => "rails_prod_log" pattern => "^$" negate => "true" what => "previous" }
The reason:
Sometimes an event/stacktrace has a broken single empty line with one newline character in it, in between the stacktrace. I wouldn't want to split that stacktrace into two separate events so I need to match on two newlines (ie "\n\n")
I'd appreciate a work-around for now until version 1.1.2 comes out.
Thanks!
Navid"
(This issue was originally filed by @ibigpapa at https://github.com/elastic/logstash/issues/2262)
"Moving https://logstash.jira.com/browse/LOGSTASH-631 to Github
Rails production.log has two empty lines in between each event. My multiline filter with pattern "\n\n" is not matching and I know for sure I have two newlines. Here is the filter I tried which isn't working with a typical rails production.log: multiline { type => "rails_prod_log" pattern => "\n\n" negate => "true" what => "previous" } The following works but isn't quite what I want: multiline { type => "rails_prod_log" pattern => "^$" negate => "true" what => "previous" } The reason: Sometimes an event/stacktrace has a broken single empty line with one newline character in it, in between the stacktrace. I wouldn't want to split that stacktrace into two separate events so I need to match on two newlines (ie "\n\n") I'd appreciate a work-around for now until version 1.1.2 comes out. Thanks! Navid"
Confirmed still occuring in 1.5