Article 57MTD Rsyslog custom imfile, multiline not working

Rsyslog custom imfile, multiline not working

by
bhanupraveeng
from LinuxQuestions.org on (#57MTD)
Hello,

I am having my application custom log as below. I want to send each "<exclusive-start id" till next string as one message. Not able to get multiline as single message. Kindly let me know what would be the issue?

Code:<exclusive-start id="3"
line1
line2
<exclusive-start id="2"
line1
line2
line3My conf file as below:

Code:module(load = "imfile")
input(
type = "imfile"
file = "/opt/splunk/other/rsysloginput/rsysloginput.log"
Tag = "gclog"
addMetadata="on"
startmsg.regex="^(<(exclusive-start))[[:space:]](id=)"
)Thankslatest?d=yIl2AUoC8zA latest?i=wvXohJMjHWc:Xhlob9wf-3Q:F7zBnMy latest?i=wvXohJMjHWc:Xhlob9wf-3Q:V_sGLiP latest?d=qj6IDK7rITs latest?i=wvXohJMjHWc:Xhlob9wf-3Q:gIN9vFwwvXohJMjHWc
External Content
Source RSS or Atom Feed
Feed Location https://feeds.feedburner.com/linuxquestions/latest
Feed Title LinuxQuestions.org
Feed Link https://www.linuxquestions.org/questions/
Reply 0 comments