https://community.dynatrace.com/t5/Troubleshooting/Troubleshooting-log-boundary-detection-in-Log-module/ta-p/300208 <H1 class="text-text-100 mt-3 -mb-1 text-[1.375rem] font-bold">Troubleshooting log record boundary detection</H1> <H2 class="text-text-100 mt-3 -mb-1 text-[1.125rem] font-bold">Table of contents</H2> <OL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-decimal flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="#summary" target="_blank" rel="noopener">Summary</A></LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="#problem" target="_blank" rel="noopener">Problem</A></LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="#troubleshooting-steps" target="_blank" rel="noopener">Troubleshooting steps</A></LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="#resolution" target="_blank" rel="noopener">Resolution</A> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="#multi-line-entries-split-across-multiple-records" target="_blank" rel="noopener">Multi-line entries split across multiple records</A></LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="#time-only-timestamps-causing-incorrect-splitting" target="_blank" rel="noopener">Time-only timestamps are causing incorrect splitting</A></LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="#two-different-timestamp-formats-in-the-same-log-file" target="_blank" rel="noopener">Two different timestamp formats in the same log file</A></LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="#mixed-plain-text-and-json-entries-not-separated-correctly" target="_blank" rel="noopener">Mixed plain text and JSON entries are not separated correctly</A></LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="#intermittent-splitting-of-multi-line-entries-with-delayed-continuation-lines" target="_blank" rel="noopener">Intermittent splitting of multi-line entries with delayed continuation lines</A></LI> </UL> </LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="#whats-next" target="_blank" rel="noopener">What's next</A></LI> </OL> <HR /> <H2 class="text-text-100 mt-3 -mb-1 text-[1.125rem] font-bold">Summary</H2> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">This article helps you troubleshoot situations where the Log module incorrectly splits incoming log content into log records, for example, stack traces appearing as separate entries instead of a single entry, or multi-line errors being grouped incorrectly. It applies to Log module deployed via OneAgent or Dynatrace Operator on both SaaS and Managed environments, and covers file-based logs and container stdout/stderr logs on Linux and Windows, including Kubernetes workloads.</P> <H2 class="text-text-100 mt-3 -mb-1 text-[1.125rem] font-bold">Problem</H2> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">You see one of the following in the Logs viewer:</P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Stack traces or multi-line errors appear as multiple records instead of a single record.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Entries that should be separate are merged into a single record.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">The same log pattern is sometimes merged correctly and sometimes split — behavior is inconsistent.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Entries with non-standard timestamp formats are not recognized as record starts.</LI> </UL> <H3 class="text-text-100 mt-2 -mb-1 text-base font-bold">Is your scenario supported?</H3> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Use the table below to check whether your boundary detection scenario is supported. If it's listed as not supported, jump to the matching resolution section for guidance or a workaround.</P> <DIV class="overflow-x-auto w-full px-2 mb-6"> <TABLE class="min-w-full border-collapse text-sm leading-[1.7] whitespace-normal"> <THEAD class="text-left"> <TR> <TH class="text-text-100 border-b-0.5 border-border-300/60 py-2 pr-4 align-top font-bold" scope="col">Scenario</TH> <TH class="text-text-100 border-b-0.5 border-border-300/60 py-2 pr-4 align-top font-bold" scope="col">Support</TH> </TR> </THEAD> <TBODY> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Logs with default-recognized timestamp formats (no custom rules configured)</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><span class="lia-unicode-emoji" title=":white_heavy_check_mark:">✅</span> Supported</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Logs with custom (non-default) timestamp formats</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><span class="lia-unicode-emoji" title=":white_heavy_check_mark:">✅</span> Supported</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Multi-line entries whose continuation lines have no timestamp</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><span class="lia-unicode-emoji" title=":white_heavy_check_mark:">✅</span> Supported</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Forcing whitespace-prefixed lines to always be treated as continuations</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><span class="lia-unicode-emoji" title=":white_heavy_check_mark:">✅</span> Supported (turn on&nbsp;<STRONG>Skip indented lines</STRONG>)</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Logs with two different timestamp formats in the same file</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><span class="lia-unicode-emoji" title=":white_heavy_check_mark:">✅</span> Supported (requires one rule per format)</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Mixed plain text and JSON entries in the same log stream</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><span class="lia-unicode-emoji" title=":white_heavy_check_mark:">✅</span> Supported (JSON lines are treated as plain text)</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Entry boundary detection without timestamp detection</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><span class="lia-unicode-emoji" title=":white_heavy_check_mark:">✅</span> Supported</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Logs whose entries begin with a consistent text pattern (no timestamp)</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><span class="lia-unicode-emoji" title=":white_heavy_check_mark:">✅</span> Supported</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Timestamps with time only, no date component</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><span class="lia-unicode-emoji" title=":cross_mark:">❌</span> Not supported</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Wildcard matching in entry boundary patterns (<CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">*</CODE> is literal)</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><span class="lia-unicode-emoji" title=":cross_mark:">❌</span> Not supported</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Single rule covering two unrelated timestamp formats</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><span class="lia-unicode-emoji" title=":cross_mark:">❌</span> Not supported</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">No timestamp on the first line of a multi-line entry</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><span class="lia-unicode-emoji" title=":cross_mark:">❌</span> Not supported (use entry boundary instead)</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">The same time format appears occasionally in continuation lines</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><span class="lia-unicode-emoji" title=":cross_mark:">❌</span> Not supported</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Overlapping/ambiguous date formats (e.g. <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">%d/%m/%Y</CODE> and <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">%m/%d/%Y</CODE>)</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><span class="lia-unicode-emoji" title=":cross_mark:">❌</span> Not supported</TD> </TR> </TBODY> </TABLE> </DIV> <H2 class="text-text-100 mt-3 -mb-1 text-[1.125rem] font-bold">Troubleshooting steps</H2> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">The following diagnosis applies across several of the scenarios in the <A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="#resolution" target="_blank" rel="noopener">Resolution</A> section.</P> <OL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-decimal flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Open the <STRONG>Log Module Self-Monitoring dashboard</STRONG> in Dynatrace. For dashboard setup and the full list of SFM events, see <A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="#" target="_blank" rel="noopener">Log Module self-monitoring</A>.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Filter by the affected log source and check for the following SFM events: <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><STRONG><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">timestamp.no_pattern</CODE> (warning)</STRONG> — Log Module found no recognized timestamp in the log content. Every line is treated as its own record with an auto-assigned observation timestamp.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><STRONG><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">timestamp.multiple_patterns</CODE> (info)</STRONG> — Log Module detected more than one timestamp format simultaneously, which can cause inconsistent boundary placement.</LI> </UL> </LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Collect a representative sample of 5–10 raw log lines from the affected source. Identify all distinct timestamp formats present.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Match what you observe to one of the scenarios below.</LI> </OL> <H2 class="text-text-100 mt-3 -mb-1 text-[1.125rem] font-bold">Resolution</H2> <H3 class="text-text-100 mt-2 -mb-1 text-base font-bold">Multi-line entries split across multiple records</H3> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Symptoms</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Stack traces appear as multiple individual log records in Dynatrace rather than a single one.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Error log entries with continuation lines (for example, XML body or HTTP response) are fragmented.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Splitting is consistent — it always happens at the same structural boundary in the log.</LI> </UL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Resolution</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">If continuation lines consistently start with a specific prefix (for example, <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">[err]</CODE>, <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">Caused by:</CODE>, <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">at com.</CODE>), configure an <STRONG>Entry boundary</STRONG> rule that matches the first line of each record rather than continuation lines.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">If the log format lacks a reliable record-start pattern, ask the application team to update the logging configuration to emit a full timestamp (including the date) at the start of each record.</LI> </UL> <HR /> <H3 class="text-text-100 mt-2 -mb-1 text-base font-bold">Time-only timestamps are causing incorrect splitting</H3> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Symptoms</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Log entries whose timestamp contains only a time component (<CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">HH:MM:SS</CODE> or <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">HH:MM:SS.mmm</CODE>) are split into multiple records.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Each line of a multi-line entry appears as a separate record.</LI> </UL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Cause</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Time-only timestamps (with no date component) are not supported by Log Module — neither by default detection nor by custom rules.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Resolution</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Choose one of the following options:</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Preferred — emit a full timestamp</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Update the application logging configuration to include the date in each timestamp, then configure a custom timestamp rule that matches the new format. For example, the strftime pattern for <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">2026-05-14 10:00:00</CODE> is <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">%Y-%m-%d %H:%M:%S</CODE>.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Alternative — use an entry boundary</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Use <STRONG>Entry boundary</STRONG> to identify record starts by a text pattern that appears only on the first line of each entry — for example, a fixed prefix, a log level tag, or a structural marker.</P> <OL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-decimal flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Go to <STRONG>Settings → Collect and capture → Log Monitoring → Timestamp/splitting configuration</STRONG>.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Create a new rule.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Set <STRONG>Timestamp search limit</STRONG> to <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">0</CODE>.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Fill in the <STRONG>Entry boundary</STRONG> field with your pattern.</LI> </OL> <HR /> <H3 class="text-text-100 mt-2 -mb-1 text-base font-bold">Two different timestamp formats in the same log file</H3> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Symptoms</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">A custom timestamp rule is configured and works for some log entries but not others.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Some entries that should be multi-line are merged; others that should be merged are split.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">The rule appears to be ignored for a subset of entries.</LI> </UL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Cause&nbsp;</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">A single timestamp rule applies only to a single timestamp format. When a log file contains two distinct formats, lines of the uncovered format are not recognized — they're treated as continuations, or each becomes its own auto-timestamped record.</P> <BLOCKQUOTE class="ml-2 border-l-4 border-border-300/10 pl-4 text-text-300"> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Important:</STRONG> Configuring any rule disables default timestamp detection for the matched source. A format that was previously auto-detected (such as ISO 8601 or RFC 3339) must be included in an explicit rule once any rule is configured.</P> </BLOCKQUOTE> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Resolution</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Create one rule per timestamp format:</P> <OL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-decimal flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Go to <STRONG>Settings</STRONG> &gt;<STRONG> Collect and capture </STRONG>&gt;<STRONG> Log Monitoring </STRONG>&gt; <STRONG>Timestamp/splitting configuration</STRONG>.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Add a rule with the pattern for the first format.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Add a separate rule with the pattern for the second format.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Apply the same <STRONG>Matcher</STRONG> to both rules so they target the same log source.</LI> </OL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Each format will then correctly trigger record boundaries for its matching lines.</P> <HR /> <H3 class="text-text-100 mt-2 -mb-1 text-base font-bold">Mixed plain text and JSON entries are not separated correctly</H3> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Symptoms</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">A log file or container stream contains both plain-text log lines and JSON objects, but they are ingested together as a single record or incorrectly grouped.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">JSON log entries are sometimes reported individually and sometimes merged with surrounding plain text lines, depending on where in the file Log module began reading.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">A timestamp/splitting rule exists, but does not reliably separate the two entry types.</LI> </UL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Cause</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Log module does not natively distinguish between plain-text and JSON entry formats within the same log stream; JSON lines are treated as plain text. Without an explicit boundary signal, Log module can't determine where one entry ends and the next begins when the entry types alternate.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Resolution</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Choose the approach that matches your log format.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Option A — Timestamp rule (preferred when each entry begins with a recognizable timestamp)</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">If each entry — both plain text and JSON — begins with a recognizable timestamp within the first 8192 bytes (the maximum value of <STRONG>Timestamp search limit</STRONG>), configure a timestamp rule for each format.</P> <OL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-decimal flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Go to <STRONG>Settings </STRONG>&gt;<STRONG> Collect and capture</STRONG> &gt;<STRONG> Log Monitoring </STRONG>&gt;<STRONG> Timestamp/splitting configuration</STRONG>.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Add a rule that matches timestamp patterns in plain text entries.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Add a separate rule that matches JSON entries using the timestamp pattern. For example, for a JSON field containing the timestamp: <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">"instant":"%Y-%m-%dT%H:%M:%S"</CODE>.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Apply the same <STRONG>Matcher</STRONG> to both rules to scope them to the same log source.</LI> </OL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Option B — Entry boundary (use when entries lack timestamps or the timestamp is not reliably positioned)</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Configure one entry boundary pattern per entry type. The pattern must match a text fragment that appears at the start of each entry.</P> <OL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-decimal flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Go to <STRONG>Settings </STRONG>&gt;<STRONG> Collect and capture </STRONG>&gt;<STRONG> Log Monitoring </STRONG>&gt;<STRONG> Timestamp/splitting configuration</STRONG>.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Create a rule and set the&nbsp;<STRONG>Entry boundary</STRONG> to a text fragment that appears at the start of JSON entries, for example, <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">{"instant":</CODE>.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Add a second rule with <STRONG>Entry boundary</STRONG> matching the start of plain text entries, for example, <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">/opt/out/</CODE> or <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">[INFO]</CODE>.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Apply the same <STRONG>Matcher</STRONG> to both rules to scope them to the same log source.</LI> </OL> <BLOCKQUOTE class="ml-2 border-l-4 border-border-300/10 pl-4 text-text-300"> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Note:</STRONG> The <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">*</CODE> character in an entry boundary pattern is treated as a literal asterisk, not as a wildcard.</P> </BLOCKQUOTE> <HR /> <H3 class="text-text-100 mt-2 -mb-1 text-base font-bold">Intermittent splitting of multi-line entries with delayed continuation lines</H3> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Symptoms</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Stack traces or multi-line error entries are sometimes merged into a single record, and sometimes split into separate records — the behavior is inconsistent for the same log pattern.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">A timestamp rule is configured correctly, but splitting still occurs intermittently.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">The issue occurs more frequently under load or when the application writes log output slowly.</LI> </UL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Cause (brief)</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Log Module holds open log records for a configurable timeout (default: 60 seconds) while waiting for continuation lines. If continuation lines (such as a stack trace body) are written after this timeout — because of application buffering, slow I/O, or high system load — the record is flushed as-is, and the late lines become standalone entries.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Workaround</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">The timeout that controls how long Log module waits for continuation lines can be increased to give the agent more time to collect delayed lines.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">This setting cannot be configured in the Dynatrace UI. Contact Dynatrace Support to have it applied in your environment.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Before requesting this change, consider the trade-offs:</P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><STRONG>Ingest delay:</STRONG> A longer timeout increases ingest delay for the last log record in each processing batch. Records that are followed by additional lines within the timeout window are unaffected.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><STRONG>Scope:</STRONG> The setting applies to an entire scope — tenant, Kubernetes cluster, host group, or host. It can't be restricted to a single log source, container, or namespace.</LI> </UL> <H2 class="text-text-100 mt-3 -mb-1 text-[1.125rem] font-bold">What's next</H2> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">For JSON parsing issues (wrong timestamp from JSON field, severity mapping), see <EM>Troubleshooting JSON log parsing</EM>.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">For missing logs (records not appearing at all), see <EM>Troubleshooting missing logs</EM>.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">For ingest delay, see <EM>Troubleshooting log ingest delay</EM>.</LI> </UL> Tue, 02 Jun 2026 13:13:36 GMT Kacper 2026-06-02T13:13:36Z https://community.dynatrace.com/t5/Troubleshooting/Troubleshooting-log-boundary-detection-in-Log-module/ta-p/300208 <P><LI-TOC indent="15" liststyle="disc" maxheadinglevel="2"></LI-TOC></P> <DIV class="lia-message-template-content-zone"> <P>*<EM>Use a table of contents for longer articles.&nbsp;</EM></P> <H1>Summary</H1> <P><EM>*This is a mandatory section.</EM></P> <P><EM>Short description of which part of the Dynatrace platform the article refers to and what kind of problem it will help resolve / task it will describe.</EM></P> <P>&nbsp;</P> <H1>Problem</H1> <P><EM>*This is a mandatory section.</EM></P> <P><EM>Provide a precise description of the problem / task to be described.</EM></P> <P>&nbsp;</P> <H1>Troubleshooting steps</H1> <P><EM>*This section can be omitted.</EM></P> <P>&nbsp;</P> <H1>Resolution</H1> <P><EM>*This section can be omitted for ticket‑creation articles.</EM></P> <H1>What's next</H1> <P><EM>*This is a mandatory section.</EM></P> </DIV> Tue, 02 Jun 2026 13:13:36 GMT https://community.dynatrace.com/t5/Troubleshooting/Troubleshooting-log-boundary-detection-in-Log-module/ta-p/300208 Kacper 2026-06-02T13:13:36Z