sumith
December 7, 2025, 7:47pm
1
Hi, I need some help with parsing multiline XML logs using Grafana Alloy.
I have the following sample log. Alloy is being used to parse it, and Grafana dashboards display the parsed logs. The issue is that I only get the first line of the log after parsing, not the full multiline XML.
2023-12-09T19:30:53.592408 INFO <?xml version='1.0' encoding='UTF-8'?>
<?xml version="1.0" encoding="UTF-8"?>
<process:permissions xmlns:process=“http://example.com/process ”>process:name Read Access</process:name>process:level 1</process:level>process:description Allows reading application data.</process:description>
<process:permision id="write">
<process:name>Write Access</process:name>
<process:level>2</process:level>
<process:description>Allows modifying application content.</process:description>
</process:permision>
<process:permision id="admin">
<process:name>Admin Access</process:name>
<process:level>3</process:level>
<process:description>Full administrative permissions.</process:description>
</process:permision>
</process:permissions>
Alloy config used:
stage.multiline {^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d+)\s+(\S+)\s+(.+)
stage.regex {^(?P<datetime>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d+)\s+(?P<log>\S+)\s+(?P<msg>.+)
Problem:
After parsing, I only get this single line:
2023-12-09T19:30:53.592408 INFO <?xml version='1.0' encoding='UTF-8'?>
The full XML block is not being included in the multiline output.
Multiline regex seems fine. But your code shows no quotes around the regex, is that correct?
I would recommend you to use the ` character to enclose the regex. If you use double quote you need to double escape special characters such as \
sumith
December 11, 2025, 9:43am
3
In the actual regex the ` character is there. I somehow missed that.
stage.multiline {
firstline = `^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d+)\s+(\S+)\s+(.+)`
max_wait_time = “10s”
max_lines = 200
}
stage.regex {
expression = `^(?P<datetime>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d+)\s+(?P<log>\S+)\s+(?P<msg>.+)`
labels_from_groups = true
}
regarding the regex, it’s parsing the labeled ad as expected, but it’s still not capturing the multiline content.
RE2 doesn’t match newlines in the any character class by default. Try setting the s flag inside your final capture group:
(?P<msg>(?s:.*))$
This is vaguely alluded to in the first example on the following doc page (but oddly enough not mentioned on the loki.process component reference page): multiline | Grafana Loki documentation
RE2 reference: Syntax · google/re2 Wiki · GitHub
I tested your configuration and at least the multi-line part is working, can you explain what you are looking to achieve again, please?
sumith
January 7, 2026, 3:55pm
6
As i mentioned in the example . the full logs should be displayed in grafana dashboard
2023-12-09T19:30:53.592408 INFO <?xml version='1.0' encoding='UTF-8'?>
<?xml version="1.0" encoding="UTF-8"?>
<process:permissions xmlns:process=“http://example.com/process” >
<process:permision id="write">
<process:name>Write Access</process:name>
<process:level>2</process:level>
<process:description>Allows modifying application content.</process:description>
</process:permision>
<process:permision id="admin">
<process:name>Admin Access</process:name>
<process:level>3</process:level>
<process:description>Full administrative permissions.</process:description>
</process:permision>
This is my test:
Test log (test.log). The second multi-line (this is a test) is for testing purpose.
2023-12-09T19:30:53.592408 INFO <?xml version='1.0' encoding='UTF-8'?>
<?xml version="1.0" encoding="UTF-8"?>
<process:permissions xmlns:process=“http://example.com/process”>
<process:permision id=“read”>
process:nameRead Access</process:name>
process:level1</process:level>
process:descriptionAllows reading application data.</process:description>
</process:permision>
<process:permision id="write">
<process:name>Write Access</process:name>
<process:level>2</process:level>
<process:description>Allows modifying application content.</process:description>
</process:permision>
<process:permision id="admin">
<process:name>Admin Access</process:name>
<process:level>3</process:level>
<process:description>Full administrative permissions.</process:description>
</process:permision>
</process:permissions>
2023-12-09T19:30:53.592408 INFO <?xml version='1.0' encoding='UTF-8'?>
this is a test
Alloy config snippet:
stage.multiline {
firstline = `^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d+)\s+(\S+)`
max_wait_time = "10s"
max_lines = 200
}
//stage.regex {
//expression = `^(?P<datetime>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d+)\s+(?P<log>\S+)\s+(?P<msg>.+)`
//labels_from_groups = true
//}
Result:
Seems to be working.
