GitBook: [1.6] 4 pages modified

Author: agup006

installation/docker.md

@@ -84,3 +84,4 @@ Alpine Linux uses Musl C library instead of Glibc. Musl is not fully compatible
 Our Docker containers images are deployed thousands of times per day, we take security and stability very seriously.
 
 The _latest_ tag _most of the time_ points to the latest stable image. When we release a major update to Fluent Bit like for example from v1.3.x to v1.4.0, we don't move _latest_ tag until 2 weeks after the release. That give us extra time to verify with our community that everything works as expected.
+

installation/windows.md

@@ -128,3 +128,4 @@ To halt the Fluent Bit service, just execute the "stop" command.
 ```text
 % sc.exe stop fluent-bit
 ```
+

installation/yocto-embedded-linux.md

@@ -14,3 +14,4 @@ It's strongly recommended to always use the stable release of Fluent Bit recipe
 ## Fluent Bit and other architectures
 
 Fluent Bit >= v1.1.x fully supports x86\_64, x86, arm32v7 and arm64v8.
+

pipeline/inputs/tail.md

@@ -79,6 +79,64 @@ In your main configuration file append the following _Input_ & _Output_ sections
     Match  *
 ```
 
+### Multi-line example
+
+When using multi-line configuration you need to first specify `Multiline On` in the configuration and use the `Parser_Firstline` and additional parser parameters `Parser_N` if needed. If we are trying to read the following Java Stacktrace as a single event 
+
+```text
+Dec 14 06:41:08 Exception in thread "main" java.lang.RuntimeException: Something has gone wrong, aborting!
+    at com.myproject.module.MyProject.badMethod(MyProject.java:22)
+    at com.myproject.module.MyProject.oneMoreMethod(MyProject.java:18)
+    at com.myproject.module.MyProject.anotherMethod(MyProject.java:14)
+    at com.myproject.module.MyProject.someMethod(MyProject.java:10)
+    at com.myproject.module.MyProject.main(MyProject.java:6)
+```
+
+We need to specify a `Parser_Firstline` parameter that matches the first line of a multi-line event. Once a match is made Fluent Bit will read all future lines until another match with `Parser_Firstline` is made . 
+
+In the case above we can use the following parser, that extracts the Time as `time` and the remaining portion of the multiline as `log`
+
+```text
+[PARSER]
+    Name multiline
+    Format regex
+    Regex /(?<time>Dec \d+ \d+\:\d+\:\d+)(?<message>.*)/
+    Time_Key  time
+    Time_Format %b %d %H:%M:%S
+```
+
+If we want to further parse the entire event we can add additional parsers with `Parser_N` where N is an integer. The final Fluent Bit configuration looks like the following:
+
+```text
+# Note this is generally added to parsers.conf and referenced in [SERVICE]
+[PARSER]
+    Name multiline
+    Format regex
+    Regex /(?<time>Dec \d+ \d+\:\d+\:\d+)(?<message>.*)/
+    Time_Key  time
+    Time_Format %b %d %H:%M:%S
+    
+[INPUT]
+    Name             tail
+    Multiline        On
+    Parser_Multiline multiline
+    Path             /var/log/java.log
+
+[OUTPUT]
+    Name             stdout
+    Match            *
+```
+
+Our output will be as follows. 
+
+```text
+[0] tail.0: [1607928428.466041977, {"message"=>"Exception in thread "main" java.lang.RuntimeException: Something has gone wrong, aborting!
+	at com.myproject.module.MyProject.badMethod(MyProject.java:22)
+	at com.myproject.module.MyProject.oneMoreMethod(MyProject.java:18)
+	at com.myproject.module.MyProject.anotherMethod(MyProject.java:14)
+	at com.myproject.module.MyProject.someMethod(MyProject.java:10)", "message"=>"at com.myproject.module.MyProject.main(MyProject.java:6)"}]
+```
+
 ## Tailing files keeping state <a id="keep_state"></a>
 
 The _tail_ input plugin a feature to save the state of the tracked files, is strongly suggested you enabled this. For this purpose the **db** property is available, e.g: