It does if the source does (check the documentation for file() or syslog() options)

I also had a log source that sent related events in separate messages that were interleaved with other messages and ended up using the program() destination to send the logs to a custom handler I wrote.

Essentially I had multiple "keys" for incoming email messages that tied events together like:

- a single incoming SMTP session (potentially with multiple messages)

- a single message ID with multiple events about the message (recipients, attachments, anti-malware, etc)

- a single delivery connection (again with multiple messages)

- a single delivery message ID again with multiple events

The program parsed these in realtime incoming stream, building internal data structures (hash of hashes) and when it looked *complete* (including a timeout) for a particular thing it would send the data across as JSON to the destination (Elasticsearch in this case)

So - long answer to your question - Yes - in a few different ways :-)

Best,

Jim

On Sun, Mar 26, 2017 at 10:02 AM, Traiano Welcome <traiano@gmail.com> wrote:

Hi 

 Does syslog-ng support multiline log messages?

Thanks,

Traiano 

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq