github-mirrors/logstash
1
0
Fork 0
mirror of https://github.com/elastic/logstash.git synced 2025-04-24 06:37:19 -04:00
Code Issues Projects Releases Packages Wiki Activity

Updates multiline use case description

Browse source
This commit is contained in:
Paul Echeverri 2015-09-02 14:35:36 -07:00
parent f25b23498c
commit 5c0e28a0cf
1 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/asciidoc/static/managing-multiline-events.asciidoc
View file

@ -4,10 +4,10 @@
Several use cases generate events that span multiple lines of text. In order to correctly handle these multline events,
Logstash needs to know how to tell which lines are part of a single event.
Whenever possible, avoid using multiline processing at all. When multiline processing is required, implement the
processing as early in the pipeline as possible. The preferred tool in the Logstash pipeline is the
{logstash}plugins-codecs-multiline.html[multiline codec], which merges lines from a single input using a simple set of
rules.
Multiline event processing is complex and relies on proper event ordering. The best way to guarantee ordered log
processing is to implement the processing as early in the pipeline as possible. The preferred tool in the Logstash
pipeline is the {logstash}plugins-codecs-multiline.html[multiline codec], which merges lines from a single input using
a simple set of rules.
For more complex needs, the {logstash}plugins-filters-multiline.html[multiline filter] performs a similar task at the
filter stage of processing, where the Logstash instance aggregates multiple inputs.