logstash multiline filter: last part of message flush

[tudit]

There was a know issue in the multiline filter that it doesn't print the last part of the input being filtered as it is still waiting for a pattern to follow and it isn't flushed out.
Has the issue been resolved. If so how?Is there a tag to flush out the last part?

[tudit]

It works by setting enable_flush to true in the multiline filter.

[jordansissel]

This is fixed in master and scheduled for the 1.5.0 release.

[jordansissel]

enable_flush is going away and was intented only for testing the plugin, not for production. This setting will be removed in the next release.

[tudit]

OK.Thanks for the update.

[rajacm2020]

While using enable_flush it works fine. But when using the grok match filter after the flush of events, the tag values gets duplicated. Is there any fix for it ?

[corey-cole]

I'm trying out 1.5.0RC2, but I'm not seeing any change when the terminal event is a multiline event.

I've distilled the example into a gist.

Edit: Nevermind. I realized that moving from the multiline codec to the multiline filter was required.

[harveysun]

Dear Logstash Team,
I downloaded the logstash-1.5.0.tar.gz and test multiline filter found the issue still exist.
The last part of message couldn't flush out.
Could you please show an example in the logstash-1.5.0? thanks in advance

[wanghq]

@harveysun, as others mentioned, you can use the multiline filter (not multiline codec):
https://www.elastic.co/guide/en/logstash/current/plugins-filters-multiline.html.