Using Sidecars to have a multiline ouptut from GELF input

[gsmith]

Hello && Welcome

I might be able to assist you. In this forum a couple community members had same issue.

@allexandre

I was wondering if I could do something similar with the sidecar function of Graylog,

One solution was using FileBeat /w GL Sidecar.

FileBeat-Multiline-Examples

Once you have the sidecar install the rest will be configured through the Web UI.

Here is another post of using multiline configuration with file beat. perhaps that might get you started.

Sidecar Multiline config

Hi! I’ve been working on a workaround for the limitations of the pipeline-grok in terms of multiline messages and I’ve successfully come up with a somewhat hacky solution that at least works in the pipeline simulator. However, as it seems, my Beats sidecar is not even transmitting the multiline messages to GrayLog for further processing, even when disabling all my pipelines and filters, Beats will not send any of the multiline java exceptions I throw at it into GrayLog. My Beats config looks …

Depending on what version your using you can use a Collector as shown below.

We do have TAG’s for Multi-line they may help in search as shown below.

Hope that helps