Graylog2 / Graylog2/graylog2-server

Is there any config for the multiline message to decode \n for linebreaks

Open
#17,997 1 comment 0 reactions 0 assignees View on GitHub
bug frontend Medium Prio to-verify triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

I got a multiline message from rsyslog like :
2023/12/21 19:03:22 1255311 [INFO]program(11) aaa\n bbb

but my graylog search result show exactly the same as the rawmsg.

I want the line feed aka \n to be show in the search result,

## Expected Behavior

2023/12/21 19:03:22 1255311 [INFO]program(11) aaa\n bbb

to be 2 lines:
2023/12/21 19:03:22 1255311 [INFO]program(11) aaa
bbb

## Current Behavior

messages are always in one line:
2023/12/21 19:03:22 1255311 [INFO]program(11) aaa\n bbb

## Possible Solution

Is there any config for the multiline message ??

I'v tried using the pipeline to replace \n to \\n

or
, but neither didnt work:

let output_1 = get_field(
field : "message"
);
let output_2 = to_string(
value : output_1,
default : ""
);
let output_3 = replace(
value : output_2,
search : "\\n",
replacement : "
"
);
set_field(
field : "message",
value : output_3,
clean_field : false
);
![image](https://github.com/Graylog2/graylog2-server/assets/9073658/bf8bfcdc-3d85-47cb-9bf2-da88809bc59d)

## Your Environment

open-core form https://github.com/Graylog2/docker-compose.git , a week ago.

* Graylog Version:
* Java Version:
* OpenSearch Version:
* MongoDB Version:
* Operating System:
* Browser version:

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.