Good afternoon

Is it possible to use logical variables in the Logstash multiline codec when describing a pattern? As can be seen from the example below, a log comes to me from the file, which contains the key values ​​for which the log should be sewn into separate blocks and transferred to the database as different documents.

Example: Values ​​to be used for stapling
input {
   file {
# codec=>"plain"
codec=>multiline {
pattern=>["T0_INPUT_XML] |[someinfo] |[check] |[time] |[cashier] |["] #stitch until the next T0_INPUT_
negate=>true
what=>next
}
path=&"t /"/home/logs/*.log"
start_position=>"beginning"
tags=>"from_file"
type=>xml_log
}
}

The problem is that before the next _INPUT_, either _OUTPUT_ or another value of"T"(for example, which is capable of accepting INPUT/OUTPUT values) can be present in the log, which must also be transferred as separate documents.Accordingly, for the pattern field I want to set several templates processing separated logical"or".Someone faced with similar? Can you give examples?

1 Answers 1

He asked the question himself and answered it himself))
input {
   file {
#codec=>"plain"
        codec=>multiline {
        pattern=>"^ \ b(T0_OUTPUT_XML)? | |(T0_INPUT_XML)" ##create patterns(tags) by which the sheet will be sorted
        negate => true
        what =>"previous" ##determines the position of the stitching tag(in this case, at the beginning of the sheet, the tag and infa until the next one specified in the pattern), if you set"next", then the pattern falls into the previous sheet
        }
        path=&"t /"/home/logs/*.log"
        start_position=>"beginning" ##determines where to start reading the list and in what sequence it will flow into the web interface in this case, SLR ..you need to fix: -)
        tags=>"from_file"
        type=>xml_log
        }
}