Skip to content

Commit

Permalink
multiline: Add regex stage example and note
Browse files Browse the repository at this point in the history
Flag (?s:.*) need be to set for regex stage to capture full traceback log to the extracted map
  • Loading branch information
azuwis committed Jun 12, 2021
1 parent d362df7 commit ea4a6ee
Showing 1 changed file with 7 additions and 5 deletions.
12 changes: 7 additions & 5 deletions docs/sources/clients/promtail/stages/multiline.md
Original file line number Diff line number Diff line change
Expand Up @@ -61,11 +61,13 @@ Exception: Sorry, this route always breaks
We would like to collapse all lines of the traceback into one multiline block. In this example, all blocks start with a timestamp in brackets. Thus we configure a `multiline` stage with the `firstline` regular expression `^\[\d{4}-\d{2}-\d{2} \d{1,2}:\d{2}:\d{2}\]`. This will match the start of the traceback but not the following lines until `Exception: Sorry, this route always breaks`. These will be part of a multiline block and one log entry in Loki.

```yaml
multiline:
# Identify timestamps as first line of a multiline block. Note the string should be in single quotes.
firstline: '^\[\d{4}-\d{2}-\d{2} \d{1,2}:\d{2}:\d{2}\]'

max_wait_time: 3s
- multiline:
# Identify timestamps as first line of a multiline block. Enclose the string in single quotes.
firstline: '^\[\d{4}-\d{2}-\d{2} \d{1,2}:\d{2}:\d{2}\]'
max_wait_time: 3s
- regex:
# Flag (?s:.*) needs to be set for regex stage to capture full traceback log in the extracted map.
expression: '^(?P<time>\[\d{4}-\d{2}-\d{2} \d{1,2}:\d{2}:\d{2}\]) (?P<message>(?s:.*))$'
```
### Custom Log Format
Expand Down

0 comments on commit ea4a6ee

Please sign in to comment.