diff --git a/modules/openstack_project/templates/logstash/indexer.conf.erb b/modules/openstack_project/templates/logstash/indexer.conf.erb index d18cef39b2..7b4eaf8ce5 100644 --- a/modules/openstack_project/templates/logstash/indexer.conf.erb +++ b/modules/openstack_project/templates/logstash/indexer.conf.erb @@ -18,7 +18,9 @@ filter { } multiline { negate => true - pattern => "^%{TIMESTAMP_ISO8601} \|" + # Special case ansible output here because it likes to go on its own + # line without a timestamp but isn't part of a mulitline event. + pattern => "(^%{TIMESTAMP_ISO8601} \||^%{WORD}%{SPACE}\|%{SPACE}%{WORD}%{SPACE}\|%{SPACE}rc=%{NUMBER}%{SPACE}>>$)" what => "previous" stream_identity => "%{host}.%{filename}" }