Pipeline rules for messages splitted in 2 or more parts

[s0p4L1N]

Found this discussion:

Collecting VMWare/VCSA-Logs - Best practice

Hi! I am trying to collect VMWare-Logs with graylog 4.2.5 → Created TCP-Syslog-Input → Tried Content-Pack from marketplace: But: There is still a lot open. According to Multiline/Fragmented Rsyslog Events - #5 by frantz - VMWare is sending multi-line-logs which are not handled, currently. So, there are logs, that do only contain: “–>”. The dashboard of the contant-pack is empty, too. Are you sending VMWare-logs to graylog? What is your concept? Do you need Logstash as “proxy”, or what …

2 years later and still multiline not supported natively ? Or maybe there is a setting that enable multiline reading ?