Pipeline rules for messages splitted in 2 or more parts

[faen]

Looks like @d_a_parker is having a very similar issue…

Handling syslog messages that are split by the source application

The application in question is almost certainly using the syslog appender functionality in log4j, and it looks like this is expected behavior: Given that applications using this part of log4j will always split the message and prepend/append the “…” string, is there anything Graylog can do to reassemble the original un-split version? Thanks!