Multiline Codec Not Working with TCP

Description

The multiline codec is not working when used with a TCP input. However, if I write the TCP input to a flat file, THEN read in the flat file and apply the multiline codec everything works as expected.

Sample Config:
input {

tcp {
codec => multiline {
pattern => "^%{TIMESTAMP_ISO8601}"
negate => "true"
what => "previous"
}
port => "8893"
type => "test"
}
}

filter {
}

output {

stdout {
debug => "true"
codec => "rubydebug"
}
}
===================================================
accounting_sample.txt:
2013-10-23T05:02Z
blah
2013-10-23T05:02Z
blah2
===================================================
cat accounting_simple.txt | nc localhost 8893
===================================================
Output:
{
"@timestamp" => "2013-10-24T12:41:52.163Z",
"message" => "2013-10-23T05:02Z\nblah\n2013-10-23T05:02Z\nblah2\n",
"@version" => "1",
"type" => "test",
"host" => "0:0:0:0:0:0:0:1%0:65050"
}
===================================================
2013-10-23T05:02Z matches {TIMESTAMP_ISO8601} according to grokdebug

Other things that didn't work for me:

  • I removed the "^" from the pattern and it still didn't work.

  • I removed the quotes from around 'negate' and 'next' just to play it safe, but that didn't work either.

Environment

None

Status

Assignee

Logstash Developers

Reporter

Chris Decker

Labels

None

Fix versions

Affects versions

Priority

Configure