-
Notifications
You must be signed in to change notification settings - Fork 15
Open
Description
I am trying to use multiline parser within this plugin and It seems that doesnt work
Ive tested it also with Java stack trace example from documentation...
My configuration:
<source>
@type tcp
tag "sometag.#{Socket.gethostname}"
port 1234
<parse>
@type multi_format
<pattern>
format regexp
expression /\<(?<pri>[0-9]+)\>(?<time>[^ ]* {1,2}[^ ]* [^ ]*) (?<host>[^ ]*) (?<message>.*)$/
time_format %b %d %H:%M:%S
</pattern>
<pattern>
format regexp
expression /\<(?<pri>[0-9]{1,3})\>(?<time>[^ ]+) (?<host>[!-~]{1,255}) (?<message>.*)$/
time_format %Y-%m-%dT%H:%M:%S.%L%z
</pattern>
<pattern>
format regexp
expression /\<(?<pri>[0-9]{1,3})\>(?<time>[^ ]+) (?<host>[!-~]{1,255}) (?<message>.*)$/
time_format %Y-%m-%dT%H:%M:%S%z
</pattern>
<pattern>
format multiline
format_firstline /\d{4}-\d{1,2}-\d{1,2}/
format1 /^(?<time>\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{1,2}:\d{1,2}) \[(?<thread>.*)\] (?<level>[^\s]+)(?<message>.*)/
</pattern>
</parse>
</source>
Metadata
Metadata
Assignees
Labels
No labels