Logstash 插件mulitline

配置选项

• pattern ： 匹配的正则表达式。
• negate： 如果是 false，指匹配正则的文本；如果是 true，指不匹配正则的文本。这里用 negateText 指代 negate 指定的文本。
• what ：如果是 previous， 将 negateText 添加到上一个输出行末尾；如果是 next，将 negateText 添加到下一个输出行的开头；

例子

[18:51:11.709] [main] ERROR DataConfigComponent.java:184 -
java.lang.NullPointerException: null
	at com.dy.shared.dataconfig.model.RoomConfig.initialize(RoomConfig.java:48)
	at litchi.core.dataconfig.DataConfigComponent.initConfigAdapter(DataConfigComponent.java:163)
	at litchi.core.dataconfig.DataConfigComponent.lambda$initConfigAdapterList$0(DataConfigComponent.java:135)
	at java.util.ArrayList.forEach(ArrayList.java:1257)
	at litchi.core.dataconfig.DataConfigComponent.initConfigAdapterList(DataConfigComponent.java:126)
	at litchi.core.dataconfig.DataConfigComponent.start(DataConfigComponent.java:275)
	at litchi.core.Litchi.start(Litchi.java:272)
	at com.fd.webserver.WebLauncher.main(WebLauncher.java:50)

写法一：

input {
    id => "java_log_plugin"
    type => "java_log"
    path => ["/data/sepb-elk/fd-log/java/*/*/*.log"]
    start_position => "beginning"
    codec => multiline {
        pattern => "^\["
        negate => true
        what => "previous"
    }      
    ...
}

写法二：

input {
    id => "java_log_plugin"
    type => "java_log"
    path => ["/data/sepb-elk/fd-log/java/*/*/*.log"]
    start_position => "beginning"
    codec => multiline {
        pattern => "^\["
        negate => false
        what => "next"
    }      
    ...
}

[1] Multiline codec plugin
[2] 第六章·Logstash深入-收集java日志