Multiline Log Parsing

Multiline log parsing groups physical lines into logical events. A timestamped header followed by indented stack frames may represent one error. The grouping rule must match the producer’s format; joining lines does not necessarily create valid JSON.

If a JSON header is followed by tabbed stack text, parse the header as an object and store the remaining lines separately. Parsing the entire joined string as JSON fails because the stack text is outside the object. Alternatively, have the producer emit one JSON object per line with the stack inside it.

Keep unfinished-event state per file or stream. Set byte, line, and timeout limits and a policy for orphan continuations and oversized events. Checkpoint recovery must account for that pending state. A finite-list demonstration that flushes at the end does not test a streaming timeout or a crash between header and continuation.

Reference: Log and telemetry collection lab.