Rsyslog custom imfile, multiline not working
by bhanupraveeng from LinuxQuestions.org on (#57MTD)
Hello,
I am having my application custom log as below. I want to send each "<exclusive-start id" till next string as one message. Not able to get multiline as single message. Kindly let me know what would be the issue?
Code:<exclusive-start id="3"
line1
line2
<exclusive-start id="2"
line1
line2
line3My conf file as below:
Code:module(load = "imfile")
input(
type = "imfile"
file = "/opt/splunk/other/rsysloginput/rsysloginput.log"
Tag = "gclog"
addMetadata="on"
startmsg.regex="^(<(exclusive-start))[[:space:]](id=)"
)Thanks


I am having my application custom log as below. I want to send each "<exclusive-start id" till next string as one message. Not able to get multiline as single message. Kindly let me know what would be the issue?
Code:<exclusive-start id="3"
line1
line2
<exclusive-start id="2"
line1
line2
line3My conf file as below:
Code:module(load = "imfile")
input(
type = "imfile"
file = "/opt/splunk/other/rsysloginput/rsysloginput.log"
Tag = "gclog"
addMetadata="on"
startmsg.regex="^(<(exclusive-start))[[:space:]](id=)"
)Thanks