1

I am trying to make the multiline field for csv file work in logstash. But the multiline for a field is not working.

My log stash.conf content is:

input {

     file {
         type => "normal"
         path => "/etc/logstash/*.csv"
         start_position => "beginning"
         sincedb_path => "/dev/null"
         codec => multiline {
                        pattern => "."
                        negate => true
                        what => "previous"
        }
     }
}


filter {
  if [type] == "normal" {
     csv {
        separator => ","
        columns => ["make", "model", "doors"]
     }
     mutate {convert => ["doors","integer"] }

  }
}


output {
   if [type] == "normal" {
      elasticsearch {
                   hosts => "<put_local_ip>"
                   user => "<put_user>"
                   password => "<put_password>"
                   index => "cars"
                   document_type => "sold_cars"
      }
      stdout {}
   }

}

.csv with multiple line (in quotes) for a field make is:

make,model,doors
mazda,mazda6,4
"mitsubishi
4000k", galant,2
honda,civic,4

After I run "logstash -f /etc/logstash/logstash.conf" I am getting parse failure, from the logs:

{
          "tags" => [
        [0] "_csvparsefailure"
    ],
    "@timestamp" => 2020-07-13T19:13:11.339Z,
          "type" => "normal",
          "host" => "<host_ip_greyedout>",
       "message" => "\"mitsubishi",
      "@version" => "1",
          "path" => "/etc/logstash/cars4.csv"
}

0 Answers0