xm_multiline sometimes not work at first line.
I am parsing my own log file send to logstash. My log file looks like as below.
2018-02-01 12:01:59,574 receive 'AccountReady' is True. account is 12345.
Current local time is 2018-02-01 12:01:59.574. Current UTC time is 2018-02-01 04:01:59.574.
2018-02-01 12:01:59,685 receive 'AccountReady' is True. account is 23456.
Current local time is 2018-02-01 12:01:59.685. Current UTC time is 2018-02-01 04:01:59.685.
2018-02-01 12:01:59,710 receive 'AccountReady' is True. account is 34567.
Current local time is 2018-02-01 12:01:59.710. Current UTC time is 2018-02-01 04:01:59.710.
2018-02-01 12:07:12,460 _Disconnect
2018-02-01 12:07:13,382 BeforeReConnect is triggered.
2018-02-01 12:07:14,449 AfterReConnec is triggered (It`s already reconnected.)
2018-02-01 12:07:14,451 Restart is not trigger because the connection is reconnected.
I have many files like this.
and the nxlog config looks like this
<Extension multi>
Module xm_multiline
HeaderLine /^(\d{4}\-(0[1-9]|1[012])\-([0|1|2]\d|3[0|1]) ([0|1]\d|2[0-3])\:([0-5]\d)\:([0-5]\d),\d{3})/
</Extension>
<Input aplogfile>
Module im_file
File "C:\\Code\\MyProj\\bin\\Debug\\Logs\\*.*"
SavePos TRUE
ReadFromLast FALSE
InputType multi
</Input>
<Output udp_logstash>
Module om_udp
Host 192.168.1.104
Port 12020
OutputType Dgram
</Output>
<Route 1>
Path aplogfile => udp_logstash
</Route>
Most of these logs are parsed correctly, but some message are not . For example , the first two line should send as one message, but it send twice for first line and second line. This situation are only happened at first line in some files. Does anyone ever touched the same problem? Thanks!