I have started logstash with multiple workers > 16.
I have multiline messages like java exceptions/java traces and want to merge them into a single event. Earlier, It was working as expected but after upgrading my ELK stack it's breaking :-(
my logstash filter :
filter {
multiline {
pattern => "(^[a-zA-Z.]+(?:Error|Exception): .+)|(^s+at .+)|(^s+... d+ more)|(^s*Caused by:.+)"
what => "previous"
}
}
logstash logs :
:message=>"Warning: Manual override - there are filters that might not work with multiple worker threads", :worker_threads=>16, :filters=>["multiline"], :level=>:warn}
Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash.
Aucun commentaire:
Enregistrer un commentaire