Help with multi line error

[Samit Pal]

Hi,
I'm using multiline feature of the core tail plugin for my log file. The config is as follows.
-------------------------------------
<source>
  type tail
  format multiline
  format_firstline /^Start-Date:/
  format1 /^Start-Date: (?<time>[^ ]+  [^ ]+)(?<msg>(.|[\n\r])+)End-Date: [^ ]+  [^ ]+/
  path /var/log/apt/history.log
  pos_file /tmp/apt.pos
  log_level debug
  tag logs.apt
</source>
----------------------------------------

My log file is like the following
===========================

Start-Date: 2014-04-22  00:13:52
Install: php5-cli (5.3.2-1ubuntu4.24)
End-Date: 2014-04-22  00:13:55

Start-Date: 2014-04-22  00:28:03
Remove: php5-cli (5.3.2-1ubuntu4.24)
End-Date: 2014-04-22  00:28:05
===========================

I’m getting this error,

[warn]: got incomplete line before first line from /var/log/apt/history.log: nil

Is there something wrong in the regexp? I have tried the fluentular website  to crosscheck my regexp which suggests the regexp to be correct. Any pointers would be highly appreciated.

[Masahiro Nakagawa]

This is warn, not error.

Fluentd prints this warning when path's file has several lines before format_firstline.

For example:

non-match-line

first line # format_firstline matched

format1 line

format2

first line # format_firstline matched

...

In this case, non-match-line exists before first line, so Fluentd prints warning.

Could you check your path's file?

If you got correct logs from in_tail, this warning is not critical.

Masahiro

--
You received this message because you are subscribed to the Google Groups "Fluentd Google Group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to fluentd+u...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.