Built in support for Multiline JSON

[eduanb]

Is your feature request related to a problem? Please describe.
It is very common to have JSON span multiple lines. This is an example log:

{
  "level": "ERROR",
  "message": "This is my message",
  "timestamp": "06:45:03.376"
}

Describe the solution you'd like
A built-in multiline parser similar to those for docker, cri, go etc. https://docs.fluentbit.io/manual/administration/configuring-fluent-bit/multiline-parsing.

[INPUT]
    name              tail
    path              /var/log/app.log
    multiline.parser  json

Describe alternatives you've considered
I was unable to get it working using the new multiline core mechanism. Every solution I had resulted in a multiline JSON being sent to the JSON parser that doesn't support it. I was able to get the workarounds discussed here for the old multiline to work: #2418

[PARSER]
    Name      custom_json_parser
    Format    json

[PARSER]
    Name           multiline_json
    Format         regex
    Regex          ^(?<data>{.*)
    
 [INPUT]
    Name          tail
    Multiline     On
    Parser_Firstline multiline_json
    path /var/log/app.log

[FILTER]
    Name                  parser
    Match                 *
    Key_Name              data
    Parser                custom_json_parser
    Unescape_Key          On

[github-actions]

This issue is stale because it has been open 90 days with no activity. Remove stale label or comment or this will be closed in 5 days. Maintainers can add the exempt-stale label.

[github-actions]

This issue was closed because it has been stalled for 5 days with no activity.