endmsg.regex

Regex that identifies the end of a multi-line message.

This parameter applies to imfile: Text File Input Module.

Name:

endmsg.regex

Scope:

input

Type:

string (see Rsyslog Parameter String Constants)

Default:

none

Required?:

no

Introduced:

8.38.0

Description

Allows processing of multi-line messages. A message is terminated when endmsg.regex matches the line that marks the end of the message. It is more flexible than readMode but has lower performance. endmsg.regex, startmsg.regex and readMode cannot all be defined for the same input.

Examples:

date stdout P start of message
date stdout P  middle of message
date stdout F  end of message

Here endmsg.regex="^[^ ]+ stdout F " matches the line with F and assembles the message start of message middle of message end of message.

Input usage

input(type="imfile" endmsg.regex="pattern")

See also

See also imfile: Text File Input Module.

---

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project

© 2008–2025 Rainer Gerhards and others. Licensed under the Apache License 2.0.