Graylog2 / Graylog2/graylog2-server
Is there any config for the multiline message to decode \n for linebreaks
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
I got a multiline message from rsyslog like :
2023/12/21 19:03:22 1255311 [INFO]program(11) aaa\n bbb
but my graylog search result show exactly the same as the rawmsg.
I want the line feed aka \n to be show in the search result,
## Expected Behavior
2023/12/21 19:03:22 1255311 [INFO]program(11) aaa\n bbb
to be 2 lines:
2023/12/21 19:03:22 1255311 [INFO]program(11) aaa
bbb
## Current Behavior
messages are always in one line:
2023/12/21 19:03:22 1255311 [INFO]program(11) aaa\n bbb
## Possible Solution
Is there any config for the multiline message ??
I'v tried using the pipeline to replace \n to \\n
or
, but neither didnt work:
let output_1 = get_field(
field : "message"
);
let output_2 = to_string(
value : output_1,
default : ""
);
let output_3 = replace(
value : output_2,
search : "\\n",
replacement : "
"
);
set_field(
field : "message",
value : output_3,
clean_field : false
);

## Your Environment
open-core form https://github.com/Graylog2/docker-compose.git , a week ago.
* Graylog Version:
* Java Version:
* OpenSearch Version:
* MongoDB Version:
* Operating System:
* Browser version:
Contributor guide
Assessment
This issue has not been assessed yet.