From 17ac82d87303517ac70f848f0339f7ad3f11a84a Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Thu, 11 Apr 2013 12:06:21 -0700
Subject: [PATCH] Better multiline handling for Jenkins console logs

* modules/openstack_project/templates/logstash/agent.conf.erb: Treat any
line not beginning with a timestamp in Jenkins console logs as belonging
to the previous log message. This keeps timestamps sane for messages
that do not have timestamps.

Change-Id: I5959e766c28efebbd6c44567262beb63ad3a0a8e
Reviewed-on: https://review.openstack.org/26777
Reviewed-by: James E. Blair <corvus@inaugust.com>
Approved: Jeremy Stanley <fungi@yuggoth.org>
Reviewed-by: Jeremy Stanley <fungi@yuggoth.org>
Tested-by: Jenkins
---
 agent.conf.erb | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/agent.conf.erb b/agent.conf.erb
index c1c8c75..ba67e52 100644
--- a/agent.conf.erb
+++ b/agent.conf.erb
@@ -18,17 +18,13 @@ filter {
   }
   multiline {
     type => "jenkins_console"
-    pattern => "^\"'$"
-    what => "previous"
-  }
-  multiline {
-    type => "jenkins_console"
-    pattern => "^Extracting templates from packages"
+    negate => true
+    pattern => "^%{DATESTAMP} \|"
     what => "previous"
   }
   grok {
     type => "jenkins_console"
-    pattern => [ "%{DATESTAMP:logdate} \| %{GREEDYDATA:logmessage}" ]
+    pattern => [ "^%{DATESTAMP:logdate} \| %{GREEDYDATA:logmessage}" ]
     add_field => [ "received_at", "%{@timestamp}" ]
   }
   date {