xm_multiline sometimes not work at first line.


#1 walilav

I am parsing my own log file send to logstash. My log file looks like as below.

2018-02-01 12:01:59,574 receive 'AccountReady' is True. account is 12345.
Current local time is 2018-02-01 12:01:59.574. Current UTC time is 2018-02-01 04:01:59.574.
2018-02-01 12:01:59,685 receive 'AccountReady' is True. account is 23456.
Current local time is 2018-02-01 12:01:59.685. Current UTC time is 2018-02-01 04:01:59.685.
2018-02-01 12:01:59,710 receive 'AccountReady' is True. account is 34567.
Current local time is 2018-02-01 12:01:59.710. Current UTC time is 2018-02-01 04:01:59.710.
2018-02-01 12:07:12,460 _Disconnect
2018-02-01 12:07:13,382 BeforeReConnect is triggered.
2018-02-01 12:07:14,449 AfterReConnec is triggered (It`s already reconnected.)
2018-02-01 12:07:14,451 Restart is not trigger because the connection is reconnected.

I have many files like this.

and the nxlog config looks like this

<Extension multi>  
    Module  xm_multiline  
	HeaderLine  /^(\d{4}\-(0[1-9]|1[012])\-([0|1|2]\d|3[0|1]) ([0|1]\d|2[0-3])\:([0-5]\d)\:([0-5]\d),\d{3})/  
</Extension>  


<Input aplogfile>  
	Module       im_file  
	File         "C:\\Code\\MyProj\\bin\\Debug\\Logs\\*.*"  
	SavePos      TRUE   
	ReadFromLast FALSE  
	InputType    multi	  
</Input>  


<Output udp_logstash>  
	Module	om_udp  
	Host	192.168.1.104  
	Port	12020  
	OutputType Dgram  
</Output>  

<Route 1>  
    Path		aplogfile => udp_logstash  
</Route>  

Most of these logs are parsed correctly, but some message are not . For example , the first two line should send as one message, but it send twice for first line and second line. This situation are only happened at first line in some files. Does anyone ever touched the same problem? Thanks!