我正在使用Filebeat-> logstash-> eleasticsearch-> kibana

Question

我们使用Kibana仪表板实现了filebeat，logstash，elastic以查看操作日志内容。我有一种情况，我从这样的不同服务获取日志：例如，对于单个服务，我们收集了像这种格式的操作日志。

timestamp <uniquerID> entry: ProcessAPI{AddEmployee} :hostname 
timestamp <uniquerID> send: UserAPI{ValidateUser} :hostname 
timestamp <uniquerID> receive: UserAPI{ValidateUser} :hostname 
timestamp <uniquerID> send: AccountAPI{ValidateAccount} :hostname 
timestamp <uniquerID> receive: AccountAPI{ValidateAccount} :hostname 
timestamp <uniquerID> exit: ProcessAPI{AddEmployee} :hostname 

I want to combine these log line to a single line like below format: 

timestamp <uniquerID> Exit:ProcessAPI{AddEmployee} :hostname| UserAPI{ValidateUser} :hostname | AccountAPI{ValidateAccount} :hostname 

Each log line has associated parent service name in the source field.Is there any solution we can adopt to achive this. 

Answer 1

您必须告诉logstash您使用多行编解码器作为输入的一部分，具有多行日志格式。它可能很复杂，并且取决于日志文件条目的特定格式，以获得编解码器的正确设置。

https://www.elastic.co/guide/en/logstash/current/plugins-codecs-multiline.html