Details
-
Type:
Bug/Feature
-
Status: Resolved (View workflow)
-
Resolution: Duplicate
-
Affects Version/s: 1.1.10
-
Fix Version/s: None
-
Labels:
Description
If you have very large log messages (e.g. SOAP messages) in a logfile you might want to put just some metadata about the message into elasticsearch, but not the large log message itself. For this usecase it would be nice if the file plugin could include the start position (as byte number) and perhaps the number of bytes of the current log message into the metadata, such that you can easily find the message if you need the full data about it.
The multline plugin needs to handle this intelligently - if it joins two log messages it should keep the minimum of the start positions (or the first start position) and add up the lengths if that's included.