You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
|`match`| Yes | String (regex) | - | A regular expression pattern used to identify line boundaries |
22
-
|`negate`| No | Boolean |`false`| When `false`, lines matching the pattern are continuation lines. When `true`, lines NOT matching the pattern are continuation lines |
23
-
|`what`| No | String |`previous`| Whether continuation lines belong to the `previous` or `next` event |
23
+
|`event_start_pattern`| One of four | String (regex) | - | A new event begins at each line matching this pattern |
24
+
|`event_end_pattern`| One of four | String (regex) | - | An event ends at each line matching this pattern (inclusive) |
25
+
|`continuation_line_start_pattern`| One of four | String (regex) | - | Lines matching this pattern are continuations of the previous event |
26
+
|`continuation_line_end_pattern`| One of four | String (regex) | - | Lines matching this pattern are prepended to the next event |
27
+
|`omit_matched_section`| No | Boolean |`false`| When true, the matched portion of the line is omitted from the output |
24
28
|`max_lines`| No | Integer |`500`| Maximum number of lines that can be combined into a single event |
25
-
|`max_length`| No | Integer |`10000`| Maximum character length of a combined multiline event |
26
-
|`line_separator`| No | String |`\n`| Separator string used when joining lines into a single event message |
29
+
|`max_length`| No | Integer |`10000`| Maximum character length of a combined multiline event. Note: a single line exceeding this limit will still be emitted as a complete event without truncation |
30
+
|`line_separator`| No | String |`\n`| Separator string used when joining lines into a single event message. Note: `BufferedReader.readLine()` strips original line endings, so the codec normalizes joined lines using this separator. Set to `""` for no separator |
31
+
|`encoding`| No | String |`UTF-8`| Character encoding to use when reading the input stream |
27
32
28
33
## How It Works
29
34
30
-
The codec reads lines from the input stream and uses the `match` regex to determine event boundaries:
35
+
The codec reads lines from the input stream and uses the configured pattern to determine event boundaries:
31
36
32
-
1.**`negate=true` + `what=previous`** (most common): A new event starts when a line matches the pattern. Lines that do NOT match are appended to the preceding event.
37
+
1.**`event_start_pattern`** (most common): Each line matching the pattern starts a new event. All subsequent non-matching lines are appended to it.
33
38
34
-
2.**`negate=false` + `what=previous`**: Lines that match the pattern are appended to the preceding event.
39
+
2.**`event_end_pattern`**: Lines are accumulated until a line matches the pattern. The matching line is included in the current event, and the next line starts a new event.
35
40
36
-
3.**`negate=true` + `what=next`**: Lines that do NOT match the pattern are prepended to the next matching line.
41
+
3.**`continuation_line_start_pattern`**: Lines matching the pattern are continuations of the previous event. Non-matching lines start new events.
37
42
38
-
4.**`negate=false` + `what=next`**: Lines that match the pattern are prepended to the next non-matching line.
43
+
4.**`continuation_line_end_pattern`**: Lines matching the pattern are prepended to the next non-matching line's event.
39
44
40
45
## Examples
41
46
42
-
### Java Stack Traces (timestamp-based grouping)
47
+
### Java Stack Traces
43
48
44
-
Each log entry starts with a timestamp. Lines without a timestamp are continuations of the previous entry.
49
+
Each log entry starts with a timestamp. Lines without a timestamp (stack frames) are part of the previous entry.
45
50
46
51
```yaml
47
52
pipeline:
48
53
source:
49
54
s3:
50
55
codec:
51
56
multiline:
52
-
match: "^\\d{4}-\\d{2}-\\d{2}"
53
-
negate: true
54
-
what: previous
57
+
event_start_pattern: "^\\d{4}-\\d{2}-\\d{2}"
55
58
```
56
59
57
60
Input:
@@ -62,51 +65,46 @@ Input:
62
65
2024-01-01 12:00:01 INFO Application recovered
63
66
```
64
67
65
-
Result: 2 events
66
-
- Event 1: The ERROR line with its full stack trace grouped together
67
-
- Event 2: The INFO line as a single event
68
+
Result: 2 events (stack trace grouped with its ERROR line)
68
69
69
-
### Java Stack Traces (pattern-based grouping)
70
+
### Delimiter-Separated Entries
70
71
71
-
Lines starting with whitespace followed by `at `, `...`, or `Caused by:` are continuations.
72
+
Log entries are separated by a `---` line.
72
73
73
74
```yaml
74
75
pipeline:
75
76
source:
76
77
s3:
77
78
codec:
78
79
multiline:
79
-
match: "^\\s+(at |\\.\\.\\.|Caused by:)"
80
-
negate: false
81
-
what: previous
80
+
event_end_pattern: "^---$"
82
81
```
83
82
84
-
### Python Tracebacks
83
+
### Stack Traces (continuation pattern)
84
+
85
+
Lines starting with whitespace followed by `at ` or `Caused by:` are continuations.
0 commit comments