Logstash multiline plugin not working for empty lines

Question

I have these logs:

2019-04-01 12:45:33.207 ERROR [validator,,,] 1 --- [tbeatExecutor-0] com.netflix.discovery.DiscoveryClient    : DiscoveryClient_VALIDATOR/e5d3dc665009:validator:8789 - was unable to send heartbeat!

com.netflix.discovery.shared.transport.TransportException: Retry limit reached; giving up on completing the request
    at com.netflix.discovery.shared.transport.decorator.RetryableEurekaHttpClient.execute(RetryableEurekaHttpClient.java:138) ~[eureka-client-1.4.12.jar!/:1.4.12]
    at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator.sendHeartBeat(EurekaHttpClientDecorator.java:89) ~[eureka-client-1.4.12.jar!/:1.4.12]
    at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator$3.execute(EurekaHttpClientDecorator.java:92) ~[eureka-client-1.4.12.jar!/:1.4.12]
    at com.netflix.discovery.shared.transport.decorator.SessionedEurekaHttpClient.execute(SessionedEurekaHttpClient.java:77) ~[eureka-client-1.4.12.jar!/:1.4.12]
    at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator.sendHeartBeat(EurekaHttpClientDecorator.java:89) ~[eureka-client-1.4.12.jar!/:1.4.12]
    ...

I want to combine all these lines to the same line, so I used this input in logstash:

input {
    tcp {
        port => 5002
        codec => json
        codec => multiline {
            pattern => "^%{TIMESTAMP_ISO8601}"
            negate => true
            what => previous
        }
        type => "logspout-logs-tcp"
    }
}

But it is not working, I don't know if it's beacuase of the empty line on the second line, if so, how can I resolve this problem? I am using logstash version 5.6.14.

Answer 1

Please check the below code,

input {
        tcp {
            port => 5002
            codec => multiline {
            pattern => "^%{TIMESTAMP_ISO8601}"
            negate => true
            what => "previous"
            }
            type => "logspout-logs-tcp"
        }
    }