After upgrading from 1.3.3 to 1.4.0 the multiline filter transforms @timestamp and message into arrays. For example I have this two-lines log entry:
My multiline configuration is
The json representation of the log becomes:
Note that the multiline filter "works", but the message is not a string with "\n" like before. Is that a new feature ? How can we grok this message ? Thank you.
when using the elasticsearch-output this behaviour kills the logstash process.
I think this is critical to a lot of logstash users.
NoMethodError: undefined method `tv_sec' for #<Array:0x1c14ae29>
sprintf at /opt/logstash/lib/logstash/event.rb:223
gsub at org/jruby/RubyString.java:3041
sprintf at /opt/logstash/lib/logstash/event.rb:209
receive at /opt/logstash/lib/logstash/outputs/elasticsearch.rb:324
handle at /opt/logstash/lib/logstash/outputs/base.rb:86
initialize at (eval):537
call at org/jruby/RubyProc.java:271
output at /opt/logstash/lib/logstash/pipeline.rb:266
outputworker at /opt/logstash/lib/logstash/pipeline.rb:225
start_outputs at /opt/logstash/lib/logstash/pipeline.rb:152
I have exactly the same problem.
I have not this problem when using logstash 1.3.3.
This implies a blocking problem : the following filters are simply ignored (date, grok, ...)
Seems really to be a duplicate of