Logstash: analyze multi-line field for elastics search

I am trying to prepare a csv file for elastics search. However, the csv file has a multi-line field in it, representing an unstructured text field. For instance,

id_num,text
1,"bla bla bla
bla bla

bla bla bla"
2, "bla bla
bla"

For csv without a multi-line field, I know how to deal with this, for example

input {
    stdin {}
}

filter {
  csv {
    separator => ','
    columns =>  ["id_num","text"]
   }
}

output {
  elasticsearch {
    host => 'localhost'
    index_type => "locality"
    flush_size => 1000
    protocol => 'http'
}

However it gave me

Unclosed quote 

error. Please, help!

+4
source share
1 answer

Have you tried the multi-line filter

eg,

filter {
  multiline {
    pattern => "(^.+id_num.+)"
    what => "next"
 }
}
0
source

All Articles