問題文
An application writes multi-line stack traces, and each record begins with a bracketed ISO 8601 timestamp at column one. Events are currently arriving one line at a time, so a single stack trace becomes dozens of events. Which configuration correctly reassembles each record into one event?
選択肢
- Leave SHOULD_LINEMERGE at its default and set MAX_TIMESTAMP_LOOKAHEAD to the length of the whole stack trace, so the parser reads far enough into the record to see where it ends inside the window it scans.
- Set TRUNCATE to a value larger than the longest stack trace, so the parser stops discarding the continuation lines and keeps them with the first line of each record.
- Set SHOULD_LINEMERGE to false and set LINE_BREAKER to a pattern that captures the whitespace immediately before the bracketed timestamp, so the break happens only at the start of a record, which is the point a bracket marks.
- Add an ingest-time eval expression that concatenates consecutive events sharing the same host, so the stack trace is rebuilt after the events have been created and the rebuilt event replaces them.