From 47efd2d9e315b5b457e7032e13a5611693f4ce35 Mon Sep 17 00:00:00 2001
From: tei-k <tei@leosys.space>
Date: Mon, 5 Oct 2020 14:42:01 +0900
Subject: [PATCH 1/2] Fix td-agent config to support multiline

---
 .../templates/td-agent-confd/td-agent-cassandra.conf.j2      | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/provision/ansible/playbooks/templates/td-agent-confd/td-agent-cassandra.conf.j2 b/provision/ansible/playbooks/templates/td-agent-confd/td-agent-cassandra.conf.j2
index 40675c08c..310c50426 100644
--- a/provision/ansible/playbooks/templates/td-agent-confd/td-agent-cassandra.conf.j2
+++ b/provision/ansible/playbooks/templates/td-agent-confd/td-agent-cassandra.conf.j2
@@ -11,8 +11,9 @@
   tag cassandra.system
   emit_unmatched_lines true
   <parse>
-    @type regexp
-    expression /^(?<level>[^ ]*) +\[(?<thread>[^\]]*)\] (?<time>[^ ]+ [^ ]+) (?<message>.*)$/
+    @type multiline
+    format_firstline /^(?<level>[^ ]*) +\[(?<thread>[^\]]*)\] (?<time>[^ ]+ [^ ]+)/
+    format1 /^(?<level>[^ ]*) +\[(?<thread>[^\]]*)\] (?<time>[^ ]+ [^ ]+) (?<message>.*)$/
     time_format %Y-%m-%d %H:%M:%S,%N
   </parse>
 </source>

From d48176baa8efc13d6d21393aeec1c16a0790829f Mon Sep 17 00:00:00 2001
From: tei-k <tei@leosys.space>
Date: Mon, 5 Oct 2020 16:05:02 +0900
Subject: [PATCH 2/2] Fix regexp

---
 .../templates/td-agent-confd/td-agent-cassandra.conf.j2         | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/provision/ansible/playbooks/templates/td-agent-confd/td-agent-cassandra.conf.j2 b/provision/ansible/playbooks/templates/td-agent-confd/td-agent-cassandra.conf.j2
index 310c50426..cdeecdf71 100644
--- a/provision/ansible/playbooks/templates/td-agent-confd/td-agent-cassandra.conf.j2
+++ b/provision/ansible/playbooks/templates/td-agent-confd/td-agent-cassandra.conf.j2
@@ -12,7 +12,7 @@
   emit_unmatched_lines true
   <parse>
     @type multiline
-    format_firstline /^(?<level>[^ ]*) +\[(?<thread>[^\]]*)\] (?<time>[^ ]+ [^ ]+)/
+    format_firstline /^[^ ]* +\[[^\]]*\] [^ ]+ [^ ]+/
     format1 /^(?<level>[^ ]*) +\[(?<thread>[^\]]*)\] (?<time>[^ ]+ [^ ]+) (?<message>.*)$/
     time_format %Y-%m-%d %H:%M:%S,%N
   </parse>