<!--
  Multi-line events.

  multi-line:<NUMBER>   fixed number of lines per event
  multi-line-regex      variable number of lines, driven by multiline_regex

  multiline_regex attributes:
    match   = start | end | all          (default start)
    replace = no-replace | wspace | tab | none   (default no-replace)
    timeout = 1 to 120 seconds           (default 5, must not exceed <age>)

  match="start" groups the content between two lines that match the regex and
  excludes the last matching line. match="end" groups until a matching line.
  match="all" groups until the whole event matches.

  Reference:
  https://documentation.wazuh.com/5.0-beta/user-manual/reference/ossec-conf/localfile.html
-->

<!-- A Python traceback becomes one event, newlines replaced with spaces. -->
<localfile>
  <log_format>multi-line-regex</log_format>
  <location>/var/log/myapp/worker.log</location>
  <multiline_regex replace="wspace">^Traceback</multiline_regex>
</localfile>

<!-- A Java stack trace: each event starts at an ISO timestamp at the
     beginning of a line. Continuation lines are indented. -->
<localfile>
  <log_format>multi-line-regex</log_format>
  <location>/var/log/myapp/service.log</location>
  <multiline_regex match="start" replace="wspace" timeout="10">^\d{4}-\d{2}-\d{2}T</multiline_regex>
</localfile>

<!-- An appliance that always writes exactly three lines per record. -->
<localfile>
  <log_format>multi-line:3</log_format>
  <location>/var/log/appliance/records.log</location>
</localfile>
