# endmsg.regex

Regex that identifies the end of a multi-line message.

This parameter applies to imfile: Text File Input Module.

Name:

  endmsg.regex

Scope:

  input

Type:

  string (see Rsyslog Parameter String Constants)

Default:

  none

Required?:

  no

Introduced:

  8.38.0

## Description

Allows processing of multi-line messages. A message is terminated when `endmsg.regex` matches the line that marks the end of the message. It is more flexible than `readMode` but has lower performance. `endmsg.regex`, `startmsg.regex` and `readMode` cannot all be defined for the same input.

Examples:

    date stdout P start of message
    date stdout P  middle of message
    date stdout F  end of message

Here `endmsg.regex="^[^ ]+ stdout F "` matches the line with `F` and assembles the message `start of message middle of message end of message`.

## Input usage

    input(type="imfile"
          File="/var/log/example.log"
          Tag="example"
          endmsg.regex="pattern")

## See also

See also imfile: Text File Input Module.

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project

© 2008–2025 Rainer Gerhards and others. Licensed under the Apache License 2.0.