Multiline log grouping with Alloy - orphan lines on restart

Grafana Alloy
1

Hi,

I’m using Grafana Alloy on Windows to collect logs from files and send them to Loki. The log files contain multiline entries — each error starts with a timestamp and is followed by a stack trace:

2026-04-14T00:01:05.221 [29] ERR An error occurred...
Quartz.JobPersistenceException: Failed to obtain DB connection...
   at MySqlConnector.Core.ServerSession.OpenTcpSocketAsync(...)
   at MySqlConnector.Core.ServerSession.ConnectAsync(...)

I configured stage.multiline to group these into single log entries and it works correctly for new logs. However, every time Alloy restarts, it sends orphan lines from the end of the file — because the file ends with stack trace lines (starting with whitespace), and stage.multiline does not persist its state between restarts.
My current config:

loki.process "logs_multiline" {
  forward_to = [loki.write.local.receiver]

  stage.multiline {
    firstline     = "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}"
    max_wait_time = "5s"
  }
}

I was thinking about adding stage.drop before stage.multiline to drop lines that don’t start with a timestamp — so orphans get discarded before multiline processing:

loki.process “logs_multiline” {
forward_to = [loki.write.local.receiver]

stage.drop {
expression = “^\s+”
}

stage.multiline {
firstline = “^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}”
max_wait_time = “5s”
}
}

My question is: does stage.drop placed before stage.multiline operate on individual lines before they are grouped? If yes, this should solve the orphan problem. If not — what is the correct approach?
I cannot modify the log format as it comes from a third-party application.
Thanks

2

So essentially your config says if the log starts with whitespace then drop it, I think that’s reasonable. It’s strange though, why Alloy would lose the state after restart. I’d assume it would keep the state of the tail and shouldn’t be reading the last line again after restarting.

I will test this out a bit later when I have some time. But I think your config will work just fine.