What is a multi-line log?
Multi-line logs contain event records spanning multiple lines. A typical example of multi-line logs is application debug logs containing stack traces. Such event records start with a timestamp, then an error message, followed by the stack trace. Multi-line logs are not uncommon, yet they need special treatment because the log collection software has to be aware of the parts that make up a single event record. Separating distinct log records is fundamental to making sense of the information gathered from multi-line logs.
- In the world of NXLog
Multi-line log messages are often stored in files or forwarded over the network without encapsulation. In this case, regular line-based log parsers do not work because the newline character does not necessarily mean the beginning of a new log record.
NXLog supports multi-line logs via the dedicated xm_multiline extension module. This module simplifies parsing multi-line log records and supports defining header lines, footer lines, and fixed line counts, amongst other features.
- Known as
multiline logs, multi-line logs, multi line logs, multiple line logs