Log entry boundary

When configuring the timestamp, the log entry boundary feature in Dynatrace allows you to define specific patterns that mark the beginning of a multi-line log entry.

In the Entry Boundary field, you can enter the pattern of the line fragment that marks the beginning of a multi-line entry. You can define multiple rules for a given log, for example, in the case of logs with several different entry formats. When defining a new rule, it is possible, but not necessary, to fill in fields such as Pattern and Timestamp search limit. These are are optional, as is the Entry Boundary field. The * character is treated literally, without wildcard support.

The agent analyzes each line of a given log, and applies it to successive rules. If a line contains a text fragment that matches the pattern of any rule, the creation of the current entry will end and the creation of a new entry will begin.

An example of a log created by a single application is given below:

Timestamp - 2024.10.01 9:30:00
Third line
First line
Timestamp - 2024.10.01 9:31:00
Third line
First line
Timestamp - 2024.10.01 9:32:00
Third line
First line
Timestamp - 2024.10.01 9:33:00
Third line

Definition of Entry Boundary: First line

Split:

Timestamp - 2024.10.01 9:30:00


Third line


First line
Timestamp - 2024.10.01 9:31:00
Third line


First line
Timestamp - 2024.10.01 9:32:00
Third line


First line
Timestamp - 2024.10.01 9:33:00
Third line

The agent can also handle the case where two different applications write to the same log with different entry formats. To achieve this, you need to add several additional rules with patterns for the different entry beginnings.

An example of a log where two different applications write with different entry formats is given below:

'info':'sun.nio.ch.NioSocketImpl.implRead',
'stream':'stdout',time': 2024-09-05 07:09:46 UTC}
<LogEntry>
<PosRequest 2024-09-05 07:16:14 UTC>
<Request>
<RequestGuid>Content: 2024-09-05 07:16:14 UTC, Id: a9bb-5227b248a0a4</RequestGuid>
</Request>
</LogEntry>
{{{'log':'\u0009at'}}
'info':'sun.nio.ch.NioSocketImpl.implRead',
'stream':'stdout',time': 2024-09-05 07:09:46 UTC}
<LogEntry>
<PosRequest 2024-09-05 07:16:14 UTC>
<Request>
<RequestGuid>Content: 2024-09-05 07:16:14 UTC, Id: a9bb-5227b248a0a4</RequestGuid>
</Request>
</LogEntry>

Entry boundary definitions:

  • Rule: <LogEntry>
  • Rule: '}}

The entries will be split as follows:

'info':'sun.nio.ch.NioSocketImpl.implRead',


'stream':'stdout',time': 2024-09-05 07:09:46 UTC}


<LogEntry>
<PosRequest 2024-09-05 07:16:14 UTC>
<Request>
<RequestGuid>Content: 2024-09-05 07:16:14 UTC, Id: a9bb-5227b248a0a4</RequestGuid>
</Request>
</LogEntry>


{{{'log':'\u0009at'}}
'info':'sun.nio.ch.NioSocketImpl.implRead',
'stream':'stdout',time': 2024-09-05 07:09:46 UTC}


<LogEntry>
<PosRequest 2024-09-05 07:16:14 UTC>
<Request>
<RequestGuid>Content: 2024-09-05 07:16:14 UTC, Id: a9bb-5227b248a0a4</RequestGuid>
</Request>
</LogEntry>