endmsg.regex¶

Regex that identifies the end of a multi-line message.

This parameter applies to imfile: Text File Input Module.

Name:: endmsg.regex
Scope:: input
Type:: string (see Rsyslog Parameter String Constants)
Default:: none
Required?:: no
Introduced:: 8.38.0

Description¶

Allows processing of multi-line messages. A message is terminated when endmsg.regex matches the line that marks the end of the message. It is more flexible than readMode but has lower performance. endmsg.regex, startmsg.regex and readMode cannot all be defined for the same input.

Examples:

date stdout P start of message
date stdout P  middle of message
date stdout F  end of message

Here endmsg.regex="^[^ ]+ stdout F " matches the line with F and assembles the message start of message middle of message end of message.

Input usage¶

input(type="imfile"
      File="/var/log/example.log"
      Tag="example"
      endmsg.regex="pattern")

See also¶

See also imfile: Text File Input Module.

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project

© 2008–2025 Rainer Gerhards and others. Licensed under the Apache License 2.0.

nnnn