loki.process stage.multiline block

[jpfletchIdentityDigital]

I have an aws ecs service that pulls rds postgres logs that dump via the json log driver. A raw log message looks like this:

{"log":"2023-06-15 19:38:20 UTC:10.104.11.247(45320):someuser@someapp:[30921]:LOG: connection authorized: user=someuser database=somedb SSL enabled (protocol=TLSv1.2, cipher=AES128-GCM-SHA256, bits=128)\n","stream":"stdout","attrs":{"tag":"rds-log-forwarder/somedb/fade2c1501dae41170642062d9e104e83b8fd216b1ba593ba5caef1e3ad3e797"},"time":"2023-06-15T19:40:37.139914672Z"}

My loki.process config has several stages which process just fine (json, regex, labels, drop) with the exception of stage.multiline:

stage.multiline {
firstline = "^\d{4}-\d{2}-\d{2}"
max_wait_time = "10s"
}
My assumption was that this expression would match '2023-06-15', but it is not working. Any suggestions would be much appreciated. I'm using grafana agent v0.33.1

[DamienCH]

Did you end up finding something ? Facing the same right now. The regex works in regex101, but it doesnt seem to apply the multiline block process in the pipeline.
On my end, I found that often when playing with regex it works best with instead of " " or ' ' .
But no luck here.

Shameful edit:
Ok nevermind, I'm a moron and I just spent one hour trying to figure it and overlooking the "forward_to". My block wasn't part of the pipeline.

This is the block that worked for me:

loki.process "multiline_log" {
forward_to = [loki.relabel.dynamic_labels.receiver]
stage.multiline {
firstline = ^[0-9]{1,2}/[0-9]{1,2}/[0-9]{4}
}
}

Log line looks like:
6/25/2024 2:30:15 PM - INFO: Errors occurred during BlahBlahBlah Interesting log.