Comment 1 for bug 1786966

My logstash configuration that replaces the iocLogServer program looks like this:

input {
    tcp {
        host => "${EPICS_IOC_LOG_INET:localhost}"
        port => "${EPICS_IOC_LOG_PORT:7004}"
        id => "iocLog-${EPICS_IOC_LOG_PORT:7004}"
        codec => "line"
    }
}

output {
    file {
        path => "/path/to/logs/ioc-%{+YYYY-MM-dd}.json"
    }
}

That output configuration creates a new file every day, but sites may send the messages straight off to their log database instead.

I'm wondering whether we might want to adjust the errlog code to support the multiline input codec by ensuring that there is a space after any '\n' that appears before the end of a message. I haven't found many multi-line messages which would need that so maybe it should be done by hand instead.

The epicsStackTrace.c code will not work well with the single-line codec but could be easily adjusted to work with the multiline one; there may be other examples that I'm not aware of. Here's the codec configuration I suggest we aim to support:

        codec => multiline {
            pattern => "^\s"
            what => "previous"
        }