From 801997456e74ec0d6ee25cd073a50c18bb696bad Mon Sep 17 00:00:00 2001 From: Shizuo Fujita Date: Fri, 24 Jul 2026 15:03:54 +0900 Subject: [PATCH 1/2] parser: clarify that multiline parser does not join separate events Closes: #338 Signed-off-by: Shizuo Fujita --- parser/multiline.md | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/parser/multiline.md b/parser/multiline.md index cb28581a..a44fb3fe 100644 --- a/parser/multiline.md +++ b/parser/multiline.md @@ -4,7 +4,14 @@ The `multiline` parser plugin parses multiline logs. This plugin is the multilin The `multiline` parser parses log with `formatN` and `format_firstline` parameters. `format_firstline` is for detecting the start line of the multiline log. `formatN`, where N's range is \[1..20\], is the list of Regexp format for multiline log. -Unlike other parser plugins, this plugin needs special code in input plugin e.g. handle `format_firstline`. So, currently, `in_tail` plugin works with `multiline` but other input plugins do not work with it. +{% hint style='warning' %} +This parser plugin itself does not join multiple lines. The logic to buffer lines and detect the start of each record is implemented in `in_tail`. + +* `` in `in_tail`: works as described in this article. +* `` and other plugins which receive already-split events: cannot join separate events into one record. It can only parse a value which already contains newline characters. + +To concatenate multiple events into one record after the input stage, use [`fluent-plugin-concat`](https://github.com/fluent-plugins-nursery/fluent-plugin-concat). +{% endhint %} ## Parameters From 2eed4909fc7b0e1edc525072c7073985c847e261 Mon Sep 17 00:00:00 2001 From: Shizuo Fujita Date: Fri, 24 Jul 2026 16:42:46 +0900 Subject: [PATCH 2/2] parser/filter: refer to under accurately The argument of `` is a tag pattern, so `` reads as a filter for the tag "parser". Describe it as the `` section under `` instead. Also add a note to filter/parser.md. The existing wording says that you can reuse the predefined formats there, which does not hold for `multiline`. Signed-off-by: Shizuo Fujita --- filter/parser.md | 4 ++++ parser/multiline.md | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/filter/parser.md b/filter/parser.md index c80bb5bc..e3d353c8 100644 --- a/filter/parser.md +++ b/filter/parser.md @@ -20,6 +20,10 @@ It is included in the Fluentd's core. `filter_parser` uses built-in parser plugins and your own customized parser plugin, so you can reuse the predefined formats like `apache2`, `json`, etc. See [Parser Plugin Overview](../parser/) for more details +{% hint style='warning' %} +`filter_parser` receives events which are already split, so `multiline` cannot join them into one record. See [`multiline`](../parser/multiline.md) for the details. +{% endhint %} + With this example, if you receive this event: ```text diff --git a/parser/multiline.md b/parser/multiline.md index a44fb3fe..1a0903fb 100644 --- a/parser/multiline.md +++ b/parser/multiline.md @@ -8,7 +8,7 @@ The `multiline` parser parses log with `formatN` and `format_firstline` paramete This parser plugin itself does not join multiple lines. The logic to buffer lines and detect the start of each record is implemented in `in_tail`. * `` in `in_tail`: works as described in this article. -* `` and other plugins which receive already-split events: cannot join separate events into one record. It can only parse a value which already contains newline characters. +* `` section under `` \([`filter_parser`](../filter/parser.md)\) and other plugins which receive already-split events: cannot join separate events into one record. It can only parse a value which already contains newline characters. To concatenate multiple events into one record after the input stage, use [`fluent-plugin-concat`](https://github.com/fluent-plugins-nursery/fluent-plugin-concat). {% endhint %}