Multi-line detection on an HTTP source only works within the confines of a single HTTP request. So if you send multiple multi-line messages within a single HTTP post request the multi-line options will apply to those messages. If you send a multi-line message as separate POST requests the multi-line options do not apply.
Sumo Logic cannot thread together multiple HTTP posts into a single message. This is due to there being no guarantee of the order of receipt (simply the nature of HTTP) and because there is no certainty that multiple clients are not sending to the same HTTP Source, which may cause additional issues with how the order of messages are received.
Comments
0 comments
Please sign in to leave a comment.