multi-line-timeout() option added to documentation

_data/external_links.yml

@@ -92,6 +92,11 @@ sn-docker-log:
   url: https://www.syslog-ng.com/whitepaper/logging-in-docker-using-syslogng8132325/
   title: [ "Logging in Docker using syslog-ng" ]
 
+sn-ml-timeout:
+  id: sn-ml-timeout
+  url: https://www.syslog-ng.com/community/b/blog/posts/multi-line-timeout-making-sure-your-last-multi-line-message-is-not-lost
+  title: [ "Multi-line-timeout: making sure your last multi-line message is not lost"]
+
 sn-ose:
   id: sn-ose
   url: https://syslog-ng.com/

_includes/doc/admin-guide/options/multi-line-timeout.md

@@ -0,0 +1,25 @@
+## multi-line-timeout()
+
+|  Type:| number|
+|Default:| N/A|
+
+*Description:*  Specifies the time (in seconds) {{ site.product.short_name }} waits without reading new data from the source, before the last (potentially partial) message is flushed and sent through the pipeline as a LogMessage.
+
+Since the multi-line source detects the end of a message via finding the beginning of the subsequent message (indented or no-garbage/suffix mode), this option can be used to flush the last multi-line message in the file after a given time.
+
+There is no default value, so it must be explicitly configured with a value higher than follow-freq(). We recommend it to be set to a multiple of follow-freq().
+
+### Example: multi-line-timeout()
+
+```config
+source s_multi {
+ file("/some/folder/events"
+  multi-line-mode("prefix-garbage")
+  multi-line-prefix('^EVENT: ')
+  multi-line-timeout(10)
+  flags("no-parse")
+ );
+}
+```
+
+For more details see the blog post Multi-line-timeout: making sure your last multi-line message is not lost.

doc/_admin-guide/060_Sources/020_File/001_File_source_options.md

@@ -35,6 +35,8 @@ The file() driver has the following options:
 
 {% include doc/admin-guide/options/multi-line-suffix.md %}
 
+{% include doc/admin-guide/options/multi-line-timeout.md %}
+
 {% include doc/admin-guide/options/pad-size.md %}
 
 {% include doc/admin-guide/options/program-override.md %}

doc/_admin-guide/060_Sources/030_Wildcard-file/000_Wildcard-file_options.md

@@ -124,6 +124,8 @@ available, set this option to **poll**.
 
 {% include doc/admin-guide/options/multi-line-suffix.md %}
 
+{% include doc/admin-guide/options/multi-line-timeout.md %}
+
 {% include doc/admin-guide/options/pad-size.md %}
 
 {% include doc/admin-guide/options/program-override.md %}

doc/_admin-guide/060_Sources/110_Pipe/000_Pipe_source_options.md

@@ -31,6 +31,8 @@ The pipe driver has the following options:
 
 {% include doc/admin-guide/options/multi-line-suffix.md %}
 
+{% include doc/admin-guide/options/multi-line-timeout.md %}
+
 {% include doc/admin-guide/options/optional.md %}
 
 {% include doc/admin-guide/options/pad-size.md %}

doc/_admin-guide/060_Sources/230_stdin/000_stdin_options.md

@@ -36,6 +36,8 @@ The stdin() driver has the following options:
 
 {% include doc/admin-guide/options/multi-line-suffix.md %}
 
+{% include doc/admin-guide/options/multi-line-timeout.md %}
+
 {% include doc/admin-guide/options/pad-size.md %}
 
 {% include doc/admin-guide/options/program-override.md %}