make default multi-line separator configurable

Author: megastef

lib/parser/multiLine.js

@@ -18,7 +18,6 @@
  */
 var flatstr = require('flatstr')
 var Evt = require('./timerEvent.js')
-
 var timer = new Evt({
   interval: Number(process.env.LOGAGENT_MULTILINE_TIMEOUT_MS) || 250,
   event: 'timeOut'
@@ -34,12 +33,17 @@ function MultiLine (delimiter, cbf) {
   this.consumer = cbf
   this.tid = 0
   if (delimiter) {
+    if (!(delimiter instanceof RegExp)) {
+      this.opt.delimiter = new RegExp(delimiter)
+    } else {
+      this.opt.delimiter = delimiter
+    }
     timer.on('timeOut', this.lineTimeout.bind(this))
   }
 }
 
 MultiLine.prototype.lineTimeout = function () {
-  if (this.lines.length > 0) {
+  if (this.lines.length > 0 && (Date.now() - this.timestamp) >= timer.interval) {
     this.consumer(flatstr(this.lines.join('\n')))
     this.lines.length = 0
     this.state = 0
@@ -50,8 +54,8 @@ MultiLine.prototype.add = function (line, cbf) {
   if (!this.opt.delimiter) {
     return cbf(line)
   }
-
   if (this.lines.length === 0) {
+    this.timestamp = Date.now()
     this.lines.push(line)
   } else { // reading in block
     if (this.opt.delimiter.test(line)) {

lib/parser/parser.js

@@ -244,7 +244,9 @@ LogParser.prototype = {
         this.sources[sourceName].reader = new MultiLine(include[0].blockStart, parser)
         return this.sources[sourceName].reader
       } else {
-        this.sources[sourceName].reader = new MultiLine(/^\S+/, parser)
+        this.sources[sourceName].reader = new MultiLine(
+            process.env.MULTILINE_DEFAULT_SEPARATOR || this.cfg.multiline.defaultSeparator || /^\S+/,
+            parser)
         return this.sources[sourceName].reader
       }
     }

patterns.yml

@@ -16,6 +16,14 @@
 # the original line might include sensitive data!
 originalLine: false
 
+# default seperator for multiline logs, 
+# which don't have a blockStart property
+# The default /^\S{2,}/ would match typical stack traces
+# All lines that start with a whitespace  or contain only one char 
+# would be attached to previous lines
+multiline:
+  defaultSeparator:  ^\S{2,}
+
 # Please note when geoIP: true
 # There will be a slight delay during first start of logagent while maxmind
 # database is downloaded. Logagent downloads the MaxMind database every 24hrs or