Combine multiline logs in Logstash

Use the multiline codec on a file input when one logical event spans several physical lines. Define the start of a new event, then attach nonmatching lines to the previous event.

Join a Java stack trace

input {
  file {
    path => "/var/log/myapp/*.log"
    start_position => "beginning"
    codec => multiline {
      pattern => "^\["
      negate => true
      what => "previous"
      auto_flush_interval => 5
      max_lines => 1000
    }
  }
}

Here ^\[ matches a literal opening bracket. These snippets assume the default config.support_escapes: false; if you enable configuration escapes, verify the backslashes passed to the regex engine. For this input:

[2024-01-15 10:30:00] ERROR Request processing failed
java.lang.NullPointerException
    at com.example.Service.process(Service.java:42)
    at com.example.Controller.handle(Controller.java:15)
[2024-01-15 10:30:01] INFO Request completed

The stack-trace lines join the first timestamped line. The next bracket-prefixed line starts another event. This assumes continuation lines do not also begin with a bracket; choose a more specific timestamp pattern if they can.

Match the actual start format

These are alternative pattern values, not simultaneous settings:

# Date at the start of a line.
pattern => "^[0-9]{4}-[0-9]{2}-[0-9]{2}"

# A bracketed logging level.
pattern => "^\[(TRACE|DEBUG|INFO|WARN|ERROR)\]"

# Date and time at the start of a line.
pattern => "^[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}"

Set buffering boundaries

Without an automatic flush interval, a final buffered event can wait for a subsequent boundary. auto_flush_interval => 5 flushes after five seconds without new data. A pause within a slowly written stack trace can therefore split it, so match the interval to the writer's behavior.

The codec's default max_lines is 500, and max_bytes also limits buffering. These limits force a flush; describing them as silently truncating and discarding the rest of the stack trace is misleading. Oversized logical events may be split across emitted events. Raising limits increases the possible memory held in buffers.

Assemble events before mixing streams

Do not attach this codec to a multi-host Beats input. Lines from independent sources can be mixed. For Filebeat, assemble multiline records in the shipper instead; current filestream configurations put multiline under parsers, while older input configurations use a different layout.

Test a normal stack trace, a final event without a following record, and a stack trace above your limits before relying on the resulting event boundaries.

References

• Elastic: codecs multiline
• Elastic: multiline
• Elastic: multiline examples