In my installation, I receive a number of very long messages that I’d like to render (in the /search
and message views) in multiple lines. I would prefer not to have to fix this from the source side due to the fact that there are many different sources and a chain of log forwarders between them.
Is it possible to add a newline to a field using an extractor? I’ve tried inserting \n, \n, but it seems they get escaped somewhere along the line, because it doesn’t show up when viewing the message.
Thanks. Could you point me to the code where this is handled? I could take a stab at implementing it.
In the meantime, for others trying to work around this limitation, here’s some bookmarklet code which can be used to convert “#012” (which rsyslog encodes newlines into) to newlines in messages in the search and message views:
javascript:(function(){for (var e of document.getElementsByClassName("field-value")) { e.textContent = e.textContent.replace(/#012/g, "\n"); };})();
Is there a way to add custom JS to the Graylog views? That would be another way of working around the issue without needing to use a bookmarklet.