I'm using multiline codec to file input plugin with following configuration:
pattern => "^%{DATESTAMP}\s{2}"
negate => true
what => previous
So it should append line to a previous entry if there are no two whitespaces after the datestamp.
The problem is in appending order because message looks like this:
r.GetContextRequest(SPRequestAuthenticationMode authenticationMode) at Microsoft.SharePoint.Administration.SPFarm.get_RequestAny() at Microsoft.SharePoint.Utilities.SPPerformanceCounterAgent.UpdateSharePointPerfmonCounters()
,
Unable to update the value of a system performance counter. The following exception was thrown: System.Runtime.InteropServices.COMException (0x800703FA): Retrieving the COM class factory for component with CLSID {BDEADF26-C265-11D0-BCED-00A0C90AB50F} failed due to the following error: 800703fa Illegal operation attempted on a registry key that has been marked for deletion. (Exception from HRESULT: 0x800703FA). at Microsoft.SharePoint.Library.SPRequest..ctor() at Microsoft.SharePoint.SPGlobal.CreateSPRequestAndSetIdentity(SPSite site, String name, Boolean bNotGlobalAdminCode, String strUrl, Boolean bNotAddToContext, Byte[] UserToken, SPAppPrincipalToken appPrincipalToken, String userName, Boolean bIgnoreTokenTimeout, Boolean bAsAnonymous) at Microsoft.SharePoint.SPRequestManage
The first line should be last in this case. Is there any way to append previous log message to the beginning instead of appending to the end?