vectordotdev / vectordotdev/vector
Default `file.multiline.mode` to `halt_before`
Open
Nobody has claimed this yet.
meta: idea
needs: approval
source: file
- Dominant language
- Rust
- Stars
- 22.6k
- Forks
- 2.3k
- Avg merge
- 1d 7h
- Merged PRs (30d)
- 146
Description
In my opinion, what's happening here should be the default. This preserves the old multi-line behavior where only a start_pattern is required. More sophisticated matching can then use mode and condition_pattern.
@MOZGIII what do you think?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading src/sources/file/line_agg.rs at lines 56-59, where the current multiline behavior is described. Confirm how the default mode is selected and update it so halt_before preserves the old behavior with only a start_pattern; done means the default is changed without requiring mode or condition_pattern.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- observability
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100