What is this?
Some devices split a single log entry across multiple syslog lines instead of sending it as one message. A mail server logging a single delivery is a common example: the queue ID, the sender, the recipient, and the final delivery status can each arrive as separate lines, seconds apart. Ingested as-is, each line becomes its own Logsign event, so a single mail transaction shows up as several disconnected, partial events.
Multiline Aggregation lets you configure a syslog source to recognize which lines belong together and merge them into a single event before parsing, so one log entry represents one real transaction.
Where to configure it
Go to Settings > Data Collection, open a syslog-based source (add a new one or edit an existing one), and expand the Multiline Aggregation panel. Check Enable Multiline Aggregation to reveal the rest of the settings.
How grouping works
Choose a Profile:
- Brightmail, Postfix, Zimbra: built-in profiles for these mail platforms. Logsign already knows how to find the shared queue/audit ID that ties their log lines together, so you don't need to supply your own extraction pattern.
- Custom: define your own Key Regexes. Logsign runs each line through your patterns and uses whatever value the first capture group returns as the correlation ID. Lines carrying the same ID, from the same source, are buffered together.
A buffered group is merged into one event as soon as any of the following happens, whichever comes first:
- An End Regex matches a line, meaning "this is the last line of the group".
- The number of buffered lines reaches Max Lines.
- The buffered size reaches Max Bytes.
- No further matching line arrives within Idle Flush seconds.
- Max Age seconds have passed since the group's first line, even if lines are still arriving.
The last two are safety limits. They guarantee a group is never held indefinitely, even if the device never sends a recognizable closing line.
Fields reference
| Field | What it does | Default |
|---|---|---|
| Profile | Brightmail, Postfix, Zimbra (built-in) or Custom | Brightmail |
| Key Regexes | Custom only. Regex(es) whose first capture group extracts the correlation ID from a line. Required for Custom. | — |
| End Regexes | Regex(es) that mark the last line of a group. Optional. | — |
| Idle Flush (seconds) | Flush a group if no new matching line arrives within this time. | 5 |
| Max Age (seconds) | Force-flush a group this many seconds after its first line, regardless of activity. Capped at 120 seconds. | 30 |
| Max Lines | Force-flush once a group reaches this many lines. | 300 |
| Max Bytes | Force-flush once a group reaches this size. | 131072 (128 KB) |
Leaving a numeric field empty applies its default.
Things to know
- End Regexes are not predefined, even for the Brightmail, Postfix, and Zimbra profiles. If you leave End Regexes empty, groups from these profiles still close correctly, but only once Idle Flush or Max Age is reached, not the moment the closing line arrives. Add your own End Regex if you want a group to close immediately when you know what its last line looks like.
- Grouping is scoped to the individual source. The same correlation ID on two different syslog sources is tracked independently and is never merged across sources.
- Multiline Aggregation applies to syslog-based sources. It does not apply to poller (API) sources.
In one sentence
Multiline Aggregation merges log lines that belong to the same transaction, based on a shared ID and a bounded time window, into one Logsign event, using either a built-in mail-platform profile or your own correlation and end patterns.