Multiline weird behavior

gistfile1.txt

 Scenario one

Configuration:

  multiline {
    type => "tomcat"
    pattern => "(^\w{3}\s\d{2}\,\s\d{4}\s[0-9|:]+\s\w{2}\s)"
    what => "next"
    add_tag => [ "merged" ]
  }
  multiline {
    type => "tomcat"
    pattern => "(^\d+\serror)|(^.+Exception: .+)|(^\s+at .+)|(^\s+... \d+ more)|(^\s*Caused by:.+)"
    what => "previous"
    exclude_tags => [ "merged" ]
    add_tag => [ "stacktrace" ]
    add_field => [ "stacktrace", "true" ]
  }

1. Incoming tomcat events are tagged with "merged" by the first multiline filter and ignored by the second filter.
2. The events are also automatically tagged as "multiline"

{"@source"=>"file://maurice.members.linode.com/var/log/tomcat6/catalina.out", "@tags"=>["grepped", "multiline", "merged"], "@fields"=>{}, "@timestamp"=>"2012-12-28T20:27:39.843Z", "@source_host"=>"maurice.members.linode.com", "@source_path"=>"/var/log/tomcat6/catalina.out", "@message"=>"Dec 28, 2012 8:25:55 PM jenkins.InitReactorRunner$1 onAttained\nINFO: Completed initialization", "@type"=>"tomcat"}

As a result of the "merged" tag NO stacktrace events are handled by the second multiline plugin.

2. Scenario Two

  multiline {
    type => "tomcat"
    pattern => "(^\w{3}\s\d{2}\,\s\d{4}\s[0-9|:]+\s\w{2}\s)"
    what => "next"
  }
  multiline {
    type => "tomcat"
    pattern => "(^\d+\serror)|(^.+Exception: .+)|(^\s+at .+)|(^\s+... \d+ more)|(^\s*Caused by:.+)"
    what => "previous"
    exclude_tags => [ "multiline" ]
    add_tag => [ "stacktrace" ]
    add_field => [ "stacktrace", "true" ]
  }

1. The events are also automatically tagged as "multiline"

{"@source"=>"file://maurice.members.linode.com/var/log/tomcat6/catalina.out", "@tags"=>["grepped", "multiline"], "@fields"=>{}, "@timestamp"=>"2012-12-28T20:32:49.810Z", "@source_host"=>"maurice.members.linode.com", "@source_path"=>"/var/log/tomcat6/catalina.out", "@message"=>"Dec 28, 2012 8:32:49 PM hudson.ExtensionFinder$GuiceFinder$4$1 get\nWARNING: Failed to instantiate. Skipping this component", "@type"=>"tomcat"}

2. The events are NOT ignored by the second multiline filter and stacktrace events are processed and outputted.

{"@source"=>"file://maurice.members.linode.com/var/log/tomcat6/catalina.out", "@tags"=>["grepped", "multiline", "stacktrace"], "@fields"=>{"stacktrace"=>["true"]}, "@timestamp"=>"2012-12-28T20:32:49.745Z", "@source_host"=>"maurice.members.linode.com", "@source_path"=>"/var/log/tomcat6/catalina.out", "@message"=>"1) Error injecting constructor, java.lang.NoClassDefFoundError: hudson/ivy/AntIvyBuildWrapper\n  at org.jfrog.hudson.ivy.ArtifactoryIvyConfigurator$DescriptorImpl.<init>(ArtifactoryIvyConfigurator.java:343)\n1 error\n\tat com.google.inject.internal.ProviderToInternalFactoryAdapter.get(ProviderToInternalFactoryAdapter.java:52)\n\tat com.google.inject.Scopes$1$1.get(Scopes.java:59)\n\tat hudson.ExtensionFinder$GuiceFinder$4$1.get(ExtensionFinder.java:422)\n\tat com.google.inject.internal.InternalFactoryToProviderAdapter.get(InternalFactoryToProviderAdapter.java:41)\n\tat com.google.inject.internal.InjectorImpl$3$1.call(InjectorImpl.java:965)\n\tat com.google.inject.internal.InjectorImpl.callInContext(InjectorImpl.java:1011)\n\tat com.google.inject.internal.InjectorImpl$3.get(InjectorImpl.java:961)\n\tat hudson.ExtensionFinder$GuiceFinder._find(ExtensionFinder.java:391)\n\tat hudson.ExtensionFinder$GuiceFinder.find(ExtensionFinder.java:382)\n\tat hudson.ExtensionFinder._find(ExtensionFinder.java:151)\n\tat hudson.ClassicPluginStrategy.findComponents(ClassicPluginStrategy.java:304)\n\tat hudson.ExtensionList.load(ExtensionList.java:295)\n\tat hudson.ExtensionList.ensureLoaded(ExtensionList.java:248)\n\tat hudson.ExtensionList.getComponents(ExtensionList.java:149)\n\tat hudson.DescriptorExtensionList.load(DescriptorExtensionList.java:182)\n\tat hudson.ExtensionList.ensureLoaded(ExtensionList.java:248)\n\tat hudson.ExtensionList.size(ExtensionList.java:157)\n\tat java.util.AbstractCollection.isEmpty(AbstractCollection.java:86)\n\tat hudson.model.labels.LabelAtom.updateTransientActions(LabelAtom.java:109)\n\tat hudson.model.labels.LabelAtom.load(LabelAtom.java:191)\n\tat jenkins.model.Jenkins.getLabelAtom(Jenkins.java:1575)\n\tat jenkins.model.Jenkins.getSelfLabel(Jenkins.java:2443)\n\tat hudson.model.Node.getAssignedLabels(Node.java:242)\n\tat jenkins.model.Jenkins$18.run(Jenkins.java:2520)\n\tat org.jvnet.hudson.reactor.TaskGraphBuilder$TaskImpl.run(TaskGraphBuilder.java:146)\n\tat org.jvnet.hudson.reactor.Reactor.runTask(Reactor.java:259)\n\tat jenkins.model.Jenkins$7.runTask(Jenkins.java:882)\n\tat org.jvnet.hudson.reactor.Reactor$2.run(Reactor.java:187)\n\tat org.jvnet.hudson.reactor.Reactor$Node.run(Reactor.java:94)\n\tat java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1110)\n\tat java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:603)\n\tat java.lang.Thread.run(Thread.java:722)\nCaused by: java.lang.NoClassDefFoundError: hudson/ivy/AntIvyBuildWrapper\n\tat java.lang.ClassLoader.defineClass1(Native Method)\n\tat java.lang.ClassLoader.defineClass(ClassLoader.java:791)\n\tat java.security.SecureClassLoader.defineClass(SecureClassLoader.java:142)\n\tat java.net.URLClassLoader.defineClass(URLClassLoader.java:449)\n\tat java.net.URLClassLoader.access$100(URLClassLoader.java:71)\n\tat java.net.URLClassLoader$1.run(URLClassLoader.java:361)\n\tat java.net.URLClassLoader$1.run(URLClassLoader.java:355)\n\tat java.security.AccessController.doPrivileged(Native Method)\n\tat java.net.URLClassLoader.findClass(URLClassLoader.java:354)\n\tat java.lang.ClassLoader.loadClass(ClassLoader.java:423)\n\tat java.lang.ClassLoader.loadClass(ClassLoader.java:356)\n\tat org.jfrog.hudson.ivy.ArtifactoryIvyConfigurator$DescriptorImpl.<init>(ArtifactoryIvyConfigurator.java:343)\n\tat org.jfrog.hudson.ivy.ArtifactoryIvyConfigurator$DescriptorImpl$$FastClassByGuice$$584e3a2b.newInstance(<generated>)\n\tat com.google.inject.internal.cglib.reflect.$FastConstructor.newInstance(FastConstructor.java:40)\n\tat com.google.inject.internal.DefaultConstructionProxyFactory$1.newInstance(DefaultConstructionProxyFactory.java:61)\n\tat com.google.inject.internal.ConstructorInjector.provision(ConstructorInjector.java:108)\n\tat com.google.inject.internal.ConstructorInjector.construct(ConstructorInjector.java:87)\n\tat com.google.inject.internal.ConstructorBindingImpl$Factory.get(ConstructorBindingImpl.java:259)\n\tat com.google.inject.internal.ProviderToInternalFactoryAdapter$1.call(ProviderToInternalFactoryAdapter.java:46)\n\tat com.google.inject.internal.InjectorImpl.callInContext(InjectorImpl.java:1018)\n\tat com.google.inject.internal.ProviderToInternalFactoryAdapter.get(ProviderToInternalFactoryAdapter.java:40)\n\t... 31 more\nCaused by: java.lang.ClassNotFoundException: hudson.ivy.AntIvyBuildWrapper\n\tat java.net.URLClassLoader$1.run(URLClassLoader.java:366)\n\tat java.net.URLClassLoader$1.run(URLClassLoader.java:355)\n\tat java.security.AccessController.doPrivileged(Native Method)\n\tat java.net.URLClassLoader.findClass(URLClassLoader.java:354)\n\tat java.lang.ClassLoader.loadClass(ClassLoader.java:423)\n\tat java.lang.ClassLoader.loadClass(ClassLoader.java:356)\n\t... 52 more\ncom.google.inject.ProvisionException: Guice provision errors:", "@type"=>"tomcat"}