I have NXLog configured by the GrayLog Sidecar collector. The generated config will be available here for a week : NXLog generated config I use multiline to get my full stack traces. It is working fine

But sometimes I get a message with two line, and my delimiters are present, twice. See this : Message in GrayLog, hosted on imgur

I am wondering why, and if there is a solution.

AskedAugust 13, 2018 - 8:54pm

Answer (1)

PErhaps your HeaderLine regexp is incorrect and does not match all headers properly.

Comments (2)

  • avezina01's picture

    Well, it seems to work fine : https://regex101.com/r/jGwUle/1

    Tested with another double line message.

    I might have to see if Beats does the same. :(

  • Zhengshi's picture

    I am not sure if it is related, but it looks like your BService and Cservice are using the same input, so you may have duplicated BService events.
    File 'C:\Services\Logs\BService\logfile*.log'
    I believe you can simplify your multi-line as well since both have the same header and endline. You should be able to remove one of the extensions and change the InputType for AService and Dservice to use the same xm_multiline extension