github-mirrors/logstash
1
0
Fork 0
mirror of https://github.com/elastic/logstash.git synced 2025-04-24 22:57:16 -04:00
Code Issues Projects Releases Packages Wiki Activity

Warn users not to use mutliline codec when multiple hosts are configured

Browse source 
Add changes from review

Fixes #6947
This commit is contained in:
DeDe Morton 2017-04-20 14:42:36 -07:00
parent 86c948c301
commit 2c651e41ea
1 changed files with 10 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

13
docs/static/managing-multiline-events.asciidoc vendored
View file

@ -5,10 +5,17 @@ Several use cases generate events that span multiple lines of text. In order to
Logstash needs to know how to tell which lines are part of a single event. Logstash needs to know how to tell which lines are part of a single event.
Multiline event processing is complex and relies on proper event ordering. The best way to guarantee ordered log Multiline event processing is complex and relies on proper event ordering. The best way to guarantee ordered log
processing is to implement the processing as early in the pipeline as possible. The preferred tool in the Logstash processing is to implement the processing as early in the pipeline as possible.
pipeline is the {logstash}plugins-codecs-multiline.html[multiline codec], which merges lines from a single input using
The <<plugins-codecs-multiline>> codec is the preferred tool for handling multiline events
in the Logstash pipeline. The multiline codec merges lines from a single input using
a simple set of rules. a simple set of rules.
IMPORTANT: If you are using a Logstash input plugin that supports multiple hosts, such as
the <<plugins-inputs-beats>> input plugin, you should not use the
<<plugins-codecs-multiline>> codec to handle multiline events. Doing so may result in the
mixing of streams and corrupted event data. In this situation, you need to handle multiline
events before sending the event data to Logstash.
The most important aspects of configuring the multiline codec are the following: The most important aspects of configuring the multiline codec are the following:
@ -20,7 +27,7 @@ value in the `pattern` option are part of the previous line. The `next` value sp
in the `pattern` option are part of the following line.* The `negate` option applies the multiline codec to lines that in the `pattern` option are part of the following line.* The `negate` option applies the multiline codec to lines that
_do not_ match the regular expression specified in the `pattern` option. _do not_ match the regular expression specified in the `pattern` option.
See the full documentation for the {logstash}plugins-codecs-multiline.html[multiline codec] plugin for more information See the full documentation for the <<plugins-codecs-multiline>> codec plugin for more information
on configuration options. on configuration options.
==== Examples of Multiline Codec Configuration ==== Examples of Multiline Codec Configuration