Add the filelog receiver under receivers in your Collector config and set include to the paths you want to tail (e.g., /var/log/myapp/*.log)
Add a multiline block inside the receiver config; provide exactly one of line_start_pattern or line_end_pattern as a regex that marks the boundary of a logical log entry
For Java stack traces use line_start_pattern: ^\d{4}-\d{2}-\d{2} so that continuation lines (Caused by:, at com.) are appended to the preceding record rather than emitted as separate logs
Use omit_pattern: true if you do not want the boundary regex match itself included in the captured log body
Add an operators list after multiline to further parse the assembled record—common operators are regex_parser, json_parser, and timestamp to extract structured fields from the combined body
Set start_at: beginning during initial testing so existing file content is ingested; change to start_at: end in production to avoid reprocessing rotated files on Collector restart
Known gotchas
A multiline block must contain exactly one of line_start_pattern or line_end_pattern—providing both is a config error
Very long multiline entries (e.g., large stack traces) can cause memory pressure if the buffer fills before a boundary is found; set a reasonable flush_period (default 5s) to emit incomplete records after a timeout
The filelog receiver tracks file offsets in a storage extension; without a persistent storage backend, a Collector restart re-reads from start_at, potentially duplicating records
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp