During using graylog collector sidecar I met some issue which I’d like to solve. When I’m sending my logs from test.log file I get every single line as a new entry. However when I’m getting for example java Exception there is multiline stack trace. Sending it line by line is pointless so I started to figure out how can I split messages by some pattern. I noticed that every single log in my test.log is starting from date:
[2017-06-30 14:29:30,596] bla bla bla
I noticed also that sidecar Input is forced with multiline pattern - moreover, I have great pattern to my date: ^[([^]]*)]
However it doesn’t work at all. It doesn’t split every message but some of them. Do you have any idea what probably I’m doing wrong?
Thanks in advance, guys!