这里我之前是在input里面配置的多行合并，合并语法为：
input {
beats {
type => beats
port => 7001
codec => multiline {
patterns_dir => ["/data/package/logstash/vendor/bundle/jruby/1.9/gems/logstash-patterns-core-2.0.2/patterns"]
pattern => ".*#ELK#.*"
what => "previous"
negate => true
}
}
}
这里我们也可以再filter里面使用multiline插件来合并多行
logstash 在filter里设置多行合并
filter {
multiline {
pattern => ".*TRACE.*"
what => "previous"
}
}
https://groups.google.com/forum/#!topic/logstash-users/7LFyeIQMmEM
