Using logstash?

[vedadramovic]

thank you for fast reply

[vogler]

you find a logstash configuration here: http://www.rocworks.at/wordpress/?p=769

[vedadramovic]

Thank you Andreas,

in case someone else, tries example on www.rocworks.at/wordpress/?p=769
I think there is an error
instead of

Code: Select all

filter {
multiline {
    pattern => "%{YEAR}.%{MONTHNUM}.%{MONTHDAY} %{TIME}"
    negate => true
    what => "previous"
  }

multiline should be placed inside input like below:

Code: Select all

input {
  file {
    path => "/proj/winccoa/smh/log/*.log"   
    codec => multiline {
       pattern => "%{YEAR}.%{MONTHNUM}.%{MONTHDAY} %{TIME}"
      negate => true
      what => "previous"
    }
  }
}

Best regards,
Vedad