Return
-
Title
Converting multi-line logs messages from windows events to single lines -
Description
When receiving messages from Windows events many of the messages are broken up into multiple lines. What is the best way to remove line breaks from these messages so that they are all one line? -
Resolution
Method 1 (no-multi-line):
You can add the following line to your log destination to automatically parse out line breaks in log messages:destination d_filelog {network(“10.8.0.4”port(601)transport(tcp)template("${MESSAGE}\n")flags(no-multi-line));};Method 2 (rewrite):Another option is to use the subst commands to remove any line endings from log messages:
rewrite r_rewrite_rule {
subst("\n", " ", value("MESSAGE"), flags(global));subst("\r", "", value("MESSAGE"), flags(global));};log {source(s_logs);rewrite(r_rewrite_rule);parser(p_metadata);destination(d_logs);flags(final);};