Instead of Single log message it displays multiple messages

(ajay) #1

Hello Team,

In our application, every message start with “2019-01-22 16:31:39+0000” as shown below

“2019-01-22 16:31:39+0000 [index:query-api] INFO [http-nio-8080-exec-10] [tId:418a017d-ce78-4a76-b2bf-b293ebc6f79f] [rId:6a128d76-3ecc-464b-8c14-d2344d6ca565] [tt:DEMO]{aId=} com.gainsight.service.PostgresAndRedshiftQueryAPIServiceImpl:HAPOSTGRES query built: SELECT t1.accountName AS “t1_AccountName”, t1.recipientEmailAddress AS “t1_RecipientEmailAddress”, t1.sfdcAccountId AS “t1_SfdcAccountId”, t1.gsid AS “t1_Gsid”, t1.participantId AS “t1_ParticipantId”, t1.participantState AS “t1_ParticipantState”, t1.participantSourceName AS “t1_ParticipantSourceName”, t1.failureReasons AS “t1_FailureReasons”, t1.contextAttributeString1 AS “t1_ContextAttributeString1”, t1.contextAttributeString2 AS “t1_ContextAttributeString2”
LIMIT 1000”

But instead of the single message, it displays as three messages in Graylog as shown in the below fig

Pls help me.

(Jan Doberstein) #2

How did you ingest the messages to Graylog?

(ajay) #3

Hello Jan Doberstein,

At The Client Side:
Install “graylog-sidecar-1.0.0-1.beta.2.x86_64.rpm” and configured “/etc/graylog/sidecar/sidecar.yml” the server details, Node Name and API Token.

At Server side:

Needed for Graylog

fields_under_root: true
fields.collector_node_id: {sidecar.nodeName} fields.gl2_source_collector: {sidecar.nodeId}


  • input_type: log
    • /data/autoqa01/query-api/logs/*query-api.log
      type: log
      hosts: [“http://{domain}:5044”]
      data: /var/cache/graylog-sidecar/filebeat/data
      logs: /var/log/graylog-sidecar

(Jan Doberstein) #4

so you use sidecar and filebeat as collector to send messages.

Please read how to read and send multi line messages with filebeat:

(ajay) #5

Thank you Jan Doberstein, Working fine with below settings
multiline.pattern: ‘^[0-9]{4}-[0-9]{2}-[0-9]{2}’
multiline.negate: true
multiline.match: after

(system) closed #6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.