The multiline codec will collapse multiline messages and merge them into a single event.
If you are using a Logstash input plugin that supports multiple hosts, such as the beats input plugin input plugin, you should not use the multiline codec to handle multiline events. Doing so may result in the mixing of streams and corrupted event data. In this situation, you need to handle multiline events before sending the event data to Logstash.
The original goal of this codec was to allow joining of multiline messages from files into a single event. For example, joining Java exception and stacktrace messages into a single event.
pattern => "pattern, a regexp"
what => "previous" or "next"
The pattern should match what you believe to be an indicator that the field is part of a multi-line event.
The what must be previous or next and indicates the relation to the multi-line event.
This says that any line starting with whitespace belongs to the previous line.
Another example is to merge lines not starting with a date up to the previous line..
This says that any line not starting with a timestamp should be merged with the previous line.
This says that any line ending with a backslash should be combined with the following line.
Default value is "10 MiB"
The accumulation of events can make logstash exit with an out of memory error if event boundaries are not correctly defined. This settings make sure to flush multiline events after reaching a number of bytes, it is used in combination max_lines.
The accumulation of events can make logstash exit with an out of memory error if event boundaries are not correctly defined. This settings make sure to flush multiline events after reaching a number of lines, it is used in combination max_bytes.
Tag multiline events with a given tag. This tag will only be added to events that actually have multiple lines in them.
Negate the regexp pattern (if not matched).
The regular expression to match.
Logstash ships by default with a bunch of patterns, so you don't necessarily need to define this yourself unless you are adding additional patterns.
If the pattern matched, does event belong to the next or previous event?