How to process Logstash Multiline entry? - filter

Question

I have a generated log file that has the following pattern :
=======================================================
Debut du traitement vcc_0pg.sh - HISTORISATION DES FICHIERS LOGS le 15/07/05 00:30
Historisation des fichiers de log OK
=======================================================
And my config file is:
filter {
multiline{
pattern => "^Debut"
what => "previous"
negate=> true
}
if [type] == "prueba"{
grok{
match => ['message',"%{GREEDYDATA:content}"]
}
mutate {
replace => [ "message", "%{content}" ]
remove_field => ["content"]
}
}
if [message] == "^=" {
drop { }
}
}
I would like to obtain part 2,it contains two lines (multiline),moreover I would like to remove part 1 and part 3. :
1: =======================================================
2: Debut du traitement vcc_0pg.sh - HISTORISATION DES FICHIERS LOGS le 15/07/05 00:30
Historisation des fichiers de log OK
3: =======================================================

Answer 1

I resolved it with:
if [type] == "debut" {
if ([message] =~ "^=") {
drop {}
}
multiline {
pattern => "^Debut"
what => "previous"
negate=> "true"
}
if ("Debut" in [message])
{
grok {
match => [ "message", "Debut du traitement %{GREEDYDATA:file} -" ]
}
grok {
match => [ "message", "%{DATE_EU:date} %{HOUR:hour}:%{MINUTE:minute}" ]
}
mutate {
add_field => { "logdate" => "%{date} %{hour}:%{minute}" }
}
date {
locale => "fr"
timezone => "Europe/Paris"
match => ["logdate", "yy/MM/dd HH:mm"]
target => "logdate"
}
mutate
{
remove_field => [ "date" ]
remove_field => [ "hour" ]
remove_field => [ "minute" ]
}
}
}