Is there any config for the multiline message to decode \n for linebreaks

[R1310328554]

I got a multiline message from rsyslog like : 2023/12/21 19:03:22 1255311 [INFO]program(11) aaa\n bbb

but my graylog search result show exactly the same as the rawmsg.

I want the line feed aka \n to be show in the search result,

Expected Behavior

2023/12/21 19:03:22 1255311 [INFO]program(11) aaa\n bbb

to be 2 lines: 2023/12/21 19:03:22 1255311 [INFO]program(11) aaa bbb

Current Behavior

messages are always in one line: 2023/12/21 19:03:22 1255311 [INFO]program(11) aaa\n bbb

Possible Solution

Is there any config for the multiline message ??

I'v tried using the pipeline to replace \n to \n

or
, but neither didnt work:

let output_1 = get_field( field : "message" ); let output_2 = to_string( value : output_1, default : "" ); let output_3 = replace( value : output_2, search : "\n", replacement : "
" ); set_field( field : "message", value : output_3, clean_field : false );

Your Environment

open-core form https://github.com/Graylog2/docker-compose.git , a week ago.

• Graylog Version:
• Java Version:
• OpenSearch Version:
• MongoDB Version:
• Operating System:
• Browser version: