Parse multiline logs - timestamp

[arebepe]

Hi,
We have an issue while parsing multiline logs, below is the td-agent parser we are using to parse the logs,

@type tail path /opt/microservice.log pos_file /opt/WDMW/td-agent_logs/microservice.log tag AlertService read_from_head true path_key filename @type multiline format_firstline /\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{1,2}:\d{1,2}.\d{3}/ format1 /^(?\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{1,2}:\d{1,2}.\d{3}) (?.*)/

Example log:

2023-04-17 10:24:23.762 [ACTIVE] ExecuteThread: '6' for queue: 'weblogic.kernel.Default (self-tuning)' INFO [sessID=, corrID=, transID=, msgID=, memberID=, serviceEntity=]- createAuditLogRequest after long check :: <com.service.audit.message.CreateAuditLogRequest>

122
abc
0000000
1212112122
2023-04-17 14:24:23.759 UTC

2023-04-17 22:14:35.49 UTC

in the above log, td-agent is skipping the line after 1212112122, as it treating next line as new line (based on the timestamp). Could you help us to parse the above multiline timestamp format?

Many thanks,
Arebe

[zoroglu]

Hi, Can you find solution?