Multiline log messages

Graylog Central (peer support)
1

Hi all,

I’m receiving messages on graylog server that contain multiple lines. Those messages when displayed in graylog interface appear as a single line, making them hard to read, i.e:

This is the message\n second line here ....\n   and another line...

According to this issue, graylog is already capable of replacing new-lines with line breaks when displaying messages, however this is not happening.

All the received messages get processed by a pipeline, where the following rule is applied:

when ....
then
  let pattern = "%{DATA:pattern}/%{DATA:service} %{DATA:host} %{GREEDYDATA:message}";
  let message_text = to_string($message.message);
  let matches = grok(pattern, message_text, true);
  set_fields(matches);
end
  • I’m using graylog-server 2.2.3.
  • Input is a RAW TCP Input

Any idea why \n do not get replaced with line breaks?
Thanks.

2

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.