Multi-line logs contain event records spanning multiple lines. A typical example of multi-line logs is application debug logs containing stack traces. Such event records start with a timestamp, then an error message, followed by the stack trace. Multi-line logs are not uncommon, yet they need special treatment because the log collection software has to be aware of the parts that make up a single event record. Separating distinct log records is fundamental to making sense of the information gathered from multi-line logs.

Multi-line log messages are often stored in files or forwarded over the network without encapsulation. In this case, regular line-based log parsers do not work because the newline character does not necessarily mean the beginning of a new log record.

multiline logs, multi-line logs, multi line logs, multiple line logs

Parsing multi-line logs
Multiline Parser (xm_multiline)
Multiple lines