module LogStash

This class is a Codec duck type Using Composition, it maps from a stream identity to a cloned codec instance via the same API as a Codec it implements the codec public API

The joinlines codec will join lines mathcing specified patterns. It is based on the multiline codec, but offers the opportunity to specify a list of patterns, whats and negates. The lists must be of equal length.

IMPORTANT: If you are using a Logstash input plugin that supports multiple hosts, such as the <<plugins-inputs-beats>> input plugin, you should not use the joinlines codec to handle multiline events. Doing so may result in the mixing of streams and corrupted event data. In this situation, you need to handle multiline events before sending the event data to Logstash.

Example usage

source,ruby

input {

stdin {
  codec => joinlines {
    patterns => [ "^The following message", "^\s*at" ]
    what => [ "next", "previous" ]
    negate => [ false, false ]
  }
}

}

The example above will join lines starting with “The following message” with the next line, and stack traces with the previous line.