Skip to content

[BUG] eventFormatMultiLine: false is not honored for logFormat: custom #200

Open
@spowell-kcc

Description

@spowell-kcc

Describe the bug
When using a custom log format for Event Logs the message line breaks are not removed when eventFormatMultiLine is set to false.

To Reproduce

This Log Config:

{
  "LogConfig": {
    "logFormat": "custom",
    "sources": [
      {
        "type": "EventLog",
        "startAtOldestRecord": true,
        "eventFormatMultiLine": false,
        "channels": [
          {
            "name": "Application",
            "level": "Verbose"
          }
        ],
        "customLogFormat": "WindowsEventLog Application %Severity% %EventID% %Message%"
      },
      {
        "type": "File",
        "directory": "c:\\inetpub\\logs",
        "filter": "*.log",
        "includeSubdirectories": true,
        "includeFileNames": true,
        "customLogFormat": "IISLog %Message%"
      }
    ]
  }
}

With these messages:

$multiLineString0 = @'
This is line 1
This is line 2
This is line 3
'@
$multiLineString1 = "This is line 1`nThis is line 2`nThis is line 3`n"
$multiLineString2 = "This is line 1`rThis is line 2`rThis is line 3`r"
$multiLineString3 = "This is line 1`r`nThis is line 2`r`nThis is line 3`r`n"

Written to the event log ... produces the following output ...

Write-EventLog -LogName Application -Source Test -EntryType Warning -EventId 1 -Message $multiLineString0

2025-01-16 01:32:59 
WindowsEventLog Application Warning 1 This is line 1 
2025-01-16 01:33:34 This is line 2
2025-01-16 01:33:34 This is line 3


Write-EventLog -LogName Application -Source Test -EntryType Warning -EventId 1 -Message $multiLineString1

WindowsEventLog Application Warning 1 This is line 1 
2025-01-16 01:35:00 This is line 2
2025-01-16 01:35:00 This is line 3
2025-01-16 01:35:00


Write-EventLog -LogName Application -Source Test -EntryType Warning -EventId 1 -Message $multiLineString2

This is line 3g Application Warning 1 This is line 1


Write-EventLog -LogName Application -Source Test -EntryType Warning -EventId 1 -Message $multiLineString3

WindowsEventLog Application Warning 1 This is line 1 
2025-01-16 01:37:02 This is line 2
2025-01-16 01:37:02 This is line 3
2025-01-16 01:37:02

Expected behavior
The log events should be written on a single line with no line breaks:

"This is line 1 This is line 2 This is line 3"

Configuration
-Tool: Log Monitor
-Version: 2.1.0, 2.1.1

Metadata

Metadata

Labels

bugSomething isn't working

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions