#logstash

using codec time of "json" is too slow for me. Is it possible to move the json decoding to the filter section?

igaskin: there is a json filter, but I would be surprised if one was faster than the other...

is that a known issue http://hastebin.com/raw/boyorofone

I do filebeats -> ls

it's been working fine for months but starting this morning, I'm seeing these kind of exception and I'm not able to ingest some logs anymore

Hi there, I'm a bit confused about the multiline filter -- I have a config that's using it, but it seems to be merging lines from two totally separate servers together which I would like it to not do. Is there any way to restrict what sets of lines are allowed to be considered together? Reading the code it seems like stream_identity may be useful, but it's not clear to me if that's headed in the right direction or not.

bbeck: what's sending the files from the remote servers?