Skip to content

[AGNTLOG-229 Multiline features FAQ #29931

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Jul 21, 2025
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions content/en/agent/logs/advanced_log_collection.md
Original file line number Diff line number Diff line change
Expand Up @@ -715,6 +715,21 @@

**Note**: The Datadog Agent does not start the log collector if there is a format issue in the global processing rules. Run the Agent's [status subcommand][6] to troubleshoot any issues.

## Multi-line log aggregation FAQ

Check warning on line 718 in content/en/agent/logs/advanced_log_collection.md

View workflow job for this annotation

GitHub Actions / vale

Datadog.headings

'Multi-line log aggregation FAQ' should use sentence-style capitalization.

**1. When should I use manual multi-line rules vs. automatic multi-line detection?**

Check warning on line 720 in content/en/agent/logs/advanced_log_collection.md

View workflow job for this annotation

GitHub Actions / vale

Datadog.pronouns

Avoid first-person pronouns such as 'I'.

If you know the format of your logs, you should use manual multi-line rules for precise control.
If you are sending lots of multi-line logs, and you are unsure of their format or don't have the means to configure all sources individually, you should use automatic multi-line detection.

Check notice on line 723 in content/en/agent/logs/advanced_log_collection.md

View workflow job for this annotation

GitHub Actions / vale

Datadog.sentencelength

Suggestion: Try to keep your sentence length to 25 words or fewer.

**2. What happens when a multi-line pattern doesn't match any logs?**

All non-JSON log lines are processed individually as separate log entries.
All JSON-formatted log lines are treated as a single line of logs, and only the first valid JSON format enters the intake; the rest are dropped.

Check notice on line 728 in content/en/agent/logs/advanced_log_collection.md

View workflow job for this annotation

GitHub Actions / vale

Datadog.sentencelength

Suggestion: Try to keep your sentence length to 25 words or fewer.

**3. What happens when there are both global rules and integration-specific rules?**
Integration-specific rules completely override global rules for the particular integration.

## Further Reading

{{< partial name="whats-next/whats-next.html" >}}
Expand Down
Loading