# Multiline logs not fully captured in Grafana Alloy

**URL:** <https://community.grafana.com/t/multiline-logs-not-fully-captured-in-grafana-alloy/160018>\
**Category:** Grafana Alloy\
**Tags:** configuration, alloy, templating\
**Created:** [December 7, 2025, 7:47pm UTC](https://community.grafana.com/t/multiline-logs-not-fully-captured-in-grafana-alloy/160018 "2025-12-07T19:47:37Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![sumith](https://avatars.discourse-cdn.com/v4/letter/s/e274bd/32.png) [@sumith](https://community.grafana.com/u/sumith)\
**Post date:** [December 7, 2025, 7:47pm UTC](https://community.grafana.com/t/multiline-logs-not-fully-captured-in-grafana-alloy/160018/1 "2025-12-07T19:47:37Z")

</div>

Hi, I need some help with **parsing multiline XML logs** using Grafana Alloy.

I have the following sample log. Alloy is being used to parse it, and Grafana dashboards display the parsed logs. **The issue is that I only get the first line of the log after parsing, not the full multiline XML.**

> 2023-12-09T19:30:53.592408 INFO \<?xml version='1.0' encoding='UTF-8'?\>
> 
> \<?xml version="1.0" encoding="UTF-8"?\>
> 
> \<process:permissions xmlns:process=“[http://example.com/process](http://example.com/process)”\>  
> \<process:permision id=“read”\>  
> process:nameRead Access\</process:name\>  
> process:level1\</process:level\>  
> process:descriptionAllows reading application data.\</process:description\>  
> \</process:permision\>
> 
> ```
> <process:permision id="write">
> <process:name>Write Access</process:name>
> <process:level>2</process:level>
> <process:description>Allows modifying application content.</process:description>
> </process:permision>
> 
> <process:permision id="admin">
> <process:name>Admin Access</process:name>
> <process:level>3</process:level>
> <process:description>Full administrative permissions.</process:description>
> </process:permision>
> 
> ```
> 
> \</process:permissions\>

**Alloy config used:**

> stage.multiline {  
> firstline = `^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d+)\s+(\S+)\s+(.+)`  
> max\_wait\_time = “10s”  
> max\_lines = 200  
> }
> 
> stage.regex {  
> expression = `^(?P<datetime>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d+)\s+(?P<log>\S+)\s+(?P<msg>.+)`  
> labels\_from\_groups = true  
> }

**Problem:**

After parsing, I only get this single line:

> 2023-12-09T19:30:53.592408 INFO \<?xml version='1.0' encoding='UTF-8'?\>

The full XML block is not being included in the multiline output.

---

<div class="post-metadata">

**Author:** ![tonyswumac](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/tonyswumac/32/22401_2.png) [@tonyswumac](https://community.grafana.com/u/tonyswumac)\
**Post date:** [December 10, 2025, 7:32pm UTC](https://community.grafana.com/t/multiline-logs-not-fully-captured-in-grafana-alloy/160018/2 "2025-12-10T19:32:12Z")

</div>

Multiline regex seems fine. But your code shows no quotes around the regex, is that correct?

I would recommend you to use the ` character to enclose the regex. If you use double quote you need to double escape special characters such as \

---

<div class="post-metadata">

**Author:** ![sumith](https://avatars.discourse-cdn.com/v4/letter/s/e274bd/32.png) [@sumith](https://community.grafana.com/u/sumith)\
**Post date:** [December 11, 2025, 9:43am UTC](https://community.grafana.com/t/multiline-logs-not-fully-captured-in-grafana-alloy/160018/3 "2025-12-11T09:43:37Z")

</div>

In the actual regex the ` character is there. I somehow missed that.

> ```
> stage.multiline {
> firstline = `^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d+)\s+(\S+)\s+(.+)`
> max_wait_time = “10s”
> max_lines = 200
> }
> 
> stage.regex {
> expression = `^(?P<datetime>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d+)\s+(?P<log>\S+)\s+(?P<msg>.+)`
> labels_from_groups = true
> }
> 
> ```

regarding the regex, it’s parsing the labeled ad as expected, but it’s still not capturing the multiline content.

---

<div class="post-metadata">

**Author:** ![tjamesking](https://avatars.discourse-cdn.com/v4/letter/t/35a633/32.png) [@tjamesking](https://community.grafana.com/u/tjamesking)\
**Post date:** [December 14, 2025, 2:21am UTC](https://community.grafana.com/t/multiline-logs-not-fully-captured-in-grafana-alloy/160018/4 "2025-12-14T02:21:21Z")

</div>

RE2 doesn’t match newlines in the _any_ character class by default. Try setting the _s_ flag inside your final capture group:

> (?P\<msg\>(?s:.\*))$

This is vaguely alluded to in the first example on the following doc page (but oddly enough not mentioned on the loki.process component reference page): [multiline | Grafana Loki documentation](https://grafana.com/docs/loki/latest/send-data/promtail/stages/multiline/)

RE2 reference: [Syntax · google/re2 Wiki · GitHub](https://github.com/google/re2/wiki/syntax)

---

<div class="post-metadata">

**Author:** ![tonyswumac](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/tonyswumac/32/22401_2.png) [@tonyswumac](https://community.grafana.com/u/tonyswumac)\
**Post date:** [December 17, 2025, 7:06pm UTC](https://community.grafana.com/t/multiline-logs-not-fully-captured-in-grafana-alloy/160018/5 "2025-12-17T19:06:54Z")

</div>

I tested your configuration and at least the multi-line part is working, can you explain what you are looking to achieve again, please?

---

<div class="post-metadata">

**Author:** ![sumith](https://avatars.discourse-cdn.com/v4/letter/s/e274bd/32.png) [@sumith](https://community.grafana.com/u/sumith)\
**Post date:** [January 7, 2026, 3:55pm UTC](https://community.grafana.com/t/multiline-logs-not-fully-captured-in-grafana-alloy/160018/6 "2026-01-07T15:55:13Z")

</div>

As i mentioned in the example . the full logs should be displayed in grafana dashboard

2023-12-09T19:30:53.592408 INFO \<?xml version='1.0' encoding='UTF-8'?\>

\<?xml version="1.0" encoding="UTF-8"?\>

\<process:permissions xmlns:process=“[http://example.com/process”](http://example.com/process%E2%80%9D)\>  
\<process:permision id=“read”\>  
process:nameRead Access\</process:name\>  
process:level1\</process:level\>  
process:descriptionAllows reading application data.\</process:description\>  
\</process:permision\>

```auto
<process:permision id="write">
    <process:name>Write Access</process:name>
    <process:level>2</process:level>
    <process:description>Allows modifying application content.</process:description>
</process:permision>

<process:permision id="admin">
    <process:name>Admin Access</process:name>
    <process:level>3</process:level>
    <process:description>Full administrative permissions.</process:description>
</process:permision>

```

---

<div class="post-metadata">

**Author:** ![tonyswumac](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/tonyswumac/32/22401_2.png) [@tonyswumac](https://community.grafana.com/u/tonyswumac)\
**Post date:** [January 7, 2026, 10:58pm UTC](https://community.grafana.com/t/multiline-logs-not-fully-captured-in-grafana-alloy/160018/7 "2026-01-07T22:58:10Z")

</div>

This is my test:

1. Test log (test.log). The second multi-line (this is a test) is for testing purpose.

```auto
2023-12-09T19:30:53.592408 INFO <?xml version='1.0' encoding='UTF-8'?>

<?xml version="1.0" encoding="UTF-8"?>
<process:permissions xmlns:process=“http://example.com/process”>
<process:permision id=“read”>
process:nameRead Access</process:name>
process:level1</process:level>
process:descriptionAllows reading application data.</process:description>
</process:permision>

<process:permision id="write">
    <process:name>Write Access</process:name>
    <process:level>2</process:level>
    <process:description>Allows modifying application content.</process:description>
</process:permision>

<process:permision id="admin">
    <process:name>Admin Access</process:name>
    <process:level>3</process:level>
    <process:description>Full administrative permissions.</process:description>
</process:permision>
</process:permissions>
2023-12-09T19:30:53.592408 INFO <?xml version='1.0' encoding='UTF-8'?>

this is a test

```

1. Alloy config snippet:

```auto
stage.multiline {
  firstline = `^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d+)\s+(\S+)`
  max_wait_time = "10s"
  max_lines = 200
}

//stage.regex {
  //expression = `^(?P<datetime>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d+)\s+(?P<log>\S+)\s+(?P<msg>.+)`
  //labels_from_groups = true
//}

```

1. Result:

 ![Screenshot 2026-01-07 at 2.55.33 PM](https://us1.discourse-cdn.com/grafana/original/3X/9/0/90315e333bc5b1d4e1650af2ab0a01ab753feb89.png)

Seems to be working.