Azure Monitor DCR Multiline Logs Not Working as Expected

Question

Azure Monitor DCR Multiline Logs Not Working as Expected

Alexander Ramdayal 0

Hi,

I'm currently using Azure Monitor Agent (AMA) and Data Collection Rules (DCR) to ingest custom logs into a Log Analytics workspace. According to Azure Monitor Documentation, it's possible to configure multiline log collection by using timestamp instead of End-of-Line in the DCR.

Here's my configuration: User's image

However, despite this configuration, I'm still seeing the logs ingested as multiple separate records instead of one consolidated log message.

User's image

Is there something I'm missing in the DCR or AMA setup to ensure proper multiline log aggregation?

Any insights or help would be highly appreciated.

Thanks!

Pranay Reddy Madireddy 5,225 Reputation points Microsoft External Staff Moderator

2025-06-09T21:21:00.64+00:00

Hi Alexander Ramdayal

Verify that the timestamp format specified in your DCR matches the format used in your log files. This is critical, as the DCR uses timestamps to determine where each new log entry begins.

The Record Delimiter should be set to TimeStamp, which is currently the only supported value for identifying the start of new log records based on timestamps.

Please confirm that your log files are structured consistently and include well-formatted timestamps. If the DCR cannot correctly recognize the timestamp at the beginning of each log entry, it may be unable to process or consolidate the logs properly.

If your logs contain multiline entries (e.g., stack traces or extended messages), make sure the multiline logging feature is enabled in your configuration. This setting allows Azure to group related lines into a single log entry for accurate ingestion.

Kindly let us know if the above helps or you need further assistance on this issue.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Alexander Ramdayal 0 Reputation points

2025-06-09T21:53:22.8333333+00:00

Hi Pranay,

I have verified that the timestamp format specified in my DCR matches the format used in my log files. You may see the screenshot I have attached in the question.

I used the sample logs given in Azure Monitor Documentation for testing purposes, and it is still ingesting multiple logs instead of consolidating the logs.

How do I enable multiline entries in my configuration? I have Record Delimiter set to TimeStamp already.

Thanks
Alexander Ramdayal 0 Reputation points

2025-06-09T21:56:34.1566667+00:00

Hi Pranay,I have verified that the timestamp format specified in my DCR matches the format used in my log files. You may see the screenshot I have attached in the question.

I used the sample logs given in Azure Monitor Documentation for testing purposes, and it is still ingesting multiple logs instead of consolidating the logs.

How do I enable multiline entries in my configuration? I have Record Delimiter set to TimeStamp already.

Thanks
Mallikarjuna Vardham 255 Reputation points Microsoft External Staff Moderator

2025-06-11T17:24:05.6833333+00:00

Hello Alexander Ramdayal,

It looks like you've set the Record Delimiter to TimeStamp, which is the right approach for time-based log aggregation. To make sure multiline logs are properly grouped together, you'll need to enable the multiline feature in your DCR.

You’ll want to set multiline.enabled to true and define regular expressions for beginRegex and endRegex to mark where each multiline log starts and ends
Alexander Ramdayal 0 Reputation points

2025-06-11T19:09:52.2633333+00:00

Hi @Mallikarjuna Vardham

Thanks for your response. How do I set multiline.enabled to true in my DCR? Does this only work with Monitor container/Container Insights? As I'm using Azure Monitor Agent to ingest the logs into a Log Analytics workspace table.
Mallikarjuna Vardham 255 Reputation points Microsoft External Staff Moderator

2025-06-12T16:44:38.4266667+00:00

Hello Alexander Ramdayal , I will test your configuration requirement in my test environment and get back to you with all relevant step in detail
Alexander Ramdayal 0 Reputation points

2025-06-12T18:18:40.45+00:00

Hi @Mallikarjuna Vardham , really appreciate the help.

1 answer

Your answer

Pranay Reddy Madireddy 5,225 Reputation points Microsoft External Staff Moderator

2025-06-09T21:21:00.64+00:00

Hi Alexander Ramdayal

Verify that the timestamp format specified in your DCR matches the format used in your log files. This is critical, as the DCR uses timestamps to determine where each new log entry begins.

The Record Delimiter should be set to TimeStamp, which is currently the only supported value for identifying the start of new log records based on timestamps.

Please confirm that your log files are structured consistently and include well-formatted timestamps. If the DCR cannot correctly recognize the timestamp at the beginning of each log entry, it may be unable to process or consolidate the logs properly.

If your logs contain multiline entries (e.g., stack traces or extended messages), make sure the multiline logging feature is enabled in your configuration. This setting allows Azure to group related lines into a single log entry for accurate ingestion.

Kindly let us know if the above helps or you need further assistance on this issue.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Alexander Ramdayal 0 Reputation points

2025-06-09T21:53:22.8333333+00:00

Hi Pranay,

I have verified that the timestamp format specified in my DCR matches the format used in my log files. You may see the screenshot I have attached in the question.

I used the sample logs given in Azure Monitor Documentation for testing purposes, and it is still ingesting multiple logs instead of consolidating the logs.

How do I enable multiline entries in my configuration? I have Record Delimiter set to TimeStamp already.

Thanks
Alexander Ramdayal 0 Reputation points

2025-06-09T21:56:34.1566667+00:00

Hi Pranay,I have verified that the timestamp format specified in my DCR matches the format used in my log files. You may see the screenshot I have attached in the question.

I used the sample logs given in Azure Monitor Documentation for testing purposes, and it is still ingesting multiple logs instead of consolidating the logs.

How do I enable multiline entries in my configuration? I have Record Delimiter set to TimeStamp already.

Thanks
Mallikarjuna Vardham 255 Reputation points Microsoft External Staff Moderator

2025-06-11T17:24:05.6833333+00:00

Hello Alexander Ramdayal,

It looks like you've set the Record Delimiter to TimeStamp, which is the right approach for time-based log aggregation. To make sure multiline logs are properly grouped together, you'll need to enable the multiline feature in your DCR.

You’ll want to set multiline.enabled to true and define regular expressions for beginRegex and endRegex to mark where each multiline log starts and ends
Alexander Ramdayal 0 Reputation points

2025-06-11T19:09:52.2633333+00:00

Hi @Mallikarjuna Vardham

Thanks for your response. How do I set multiline.enabled to true in my DCR? Does this only work with Monitor container/Container Insights? As I'm using Azure Monitor Agent to ingest the logs into a Log Analytics workspace table.
Mallikarjuna Vardham 255 Reputation points Microsoft External Staff Moderator

2025-06-12T16:44:38.4266667+00:00

Hello Alexander Ramdayal , I will test your configuration requirement in my test environment and get back to you with all relevant step in detail
Alexander Ramdayal 0 Reputation points

2025-06-12T18:18:40.45+00:00

Hi @Mallikarjuna Vardham , really appreciate the help.

Answer 1

Alexander Ramdayal 0

Here's a quick update, after updating the Azure Monitor Agent (AMA), the record delimiter with Timestamp is working normally now.

Thanks all for information and help!

Share via

Azure Monitor DCR Multiline Logs Not Working as Expected

1 answer

Your answer