<Way 1> Use fluent filter plugin to combine log lines
<filter ** >
@type concat
key message
use_first_timestamp true
partial_key logtag
partial_value P
seperator ""
</filter><Way 2> Turn your log into JSON format in your application
e.g. Java application
pom.xml
<dependency>
<groupId>ch.qos.logback.contrib</groupId>
<artifactId>logback-json-classic</artifactId>
<version>0.1.5</version>
</dependency>
<dependency>
<groupId>ch.qos.logback.contrib</groupId>
<artifactId>logback-jackson</artifactId>
<version>0.1.5</version>
</dependency>
<dependency>
<groupId>net.logstash.logback</groupId>
<artifactId>logstash-logback-encoder</artifactId>
<version>6.6</version>
</dependency>logback.xml
<appender name="JSON" class="ch.qos.logback.core.ConsoleAppender">
<layout class="ch.qos.logback.contrib.json.classic.JsonLayout">
<jsonFormatter class="ch.qos.logback.contrib.jackson.JacksonJsonFormatter" />
<timestampFormat>yyyy-MM-dd HH:mm:ss</timestampFormat>
<appendLineSeparator>true</appendLineSeparator>
</layout>
<encoder class="net.logstash.logback.encoder.LogstashEncoder">
<timeZone>UTC</timeZone>
<timestampPattern>yyyy/MM/dd HH:mm:ss.SSS</timestampPattern>
<customFields>{"appname":"ES_DATA_INITIAL"}</customFields>
<includeMdc>true</includeMdc>
<includeMdcKeyName>sessionId</includeMdcKeyName>
<includeCallerData>true</includeCallerData>
<fieldNames>
<timestamp>log_timestamp</timestamp>
<version>[ignore]</version>
<levelValue>[ignore]</levelValue>
<stackTrace>exception</stackTrace>
</fieldNames>
</encoder>
</appender>
