James,

so basically Loggregator does not support such correlation itself and it is
totally left to the downstream processor to do the aggregation, right?
When my service write exception stack trace into the log as follows:

2015-05-18 14:40:41 +0000 WARN
com.pearson.grid.registrar.commonutils.logging.LoggingMessageObserver
[LoggingMessageObserver.java:125] GET http://localhost:3004/ threw
exception: FileNotFoundException -
E:\Src\Registrar\escrow\service\config\version.properties (The system
cannot find the file specified)
java.io.FileInputStream.open(Native Method)
java.io.FileInputStream.<init>(FileInputStream.java:138)
com.pearson.grid.registrar.commonutils.Version.readProperties(Version.java:77)

Loggregator sends the following to downstream logstash:

2015-05-18 14:40:41 +0000 [App/0] OUT [escrow] [pool-3-thread-1052] WARN
com.pearson.grid.registrar.commonutils.logging.LoggingMessageObserver
[LoggingMessageObserver.java:142] GET http://escrow.cf.pd-cloud.com/ threw
exception: FileNotFoundException - config\version.properties (No such file
or directory)
2015-05-18 14:40:41 +0000 [App/0] OUT java.io.FileInputStream.open(Native
Method)
2015-05-18 14:40:41 +0000 [App/0] OUT
java.io.FileInputStream.<init>(FileInputStream.java:146)
2015-05-18 14:40:41 +0000 [App/0] OUT
com.pearson.grid.registrar.commonutils.Version.readProperties(Version.java:77)

Ideally we want to keep all these as a single log "event" in the final log.
The way to do this in logstash is to config logstash so it would aggregate
all lines not staring with a timestamp (or any identifiable marker) to
previous lines:

input {
file {
codec => multiline {
pattern => "^%{TIMESTAMP_ISO8601} "
...
}
}

So I think my exact question is if there is a similar way to config
loggregator so it does the same thing.

In the previous thread
https://groups.google.com/a/cloudfoundry.org/forum/?utm_medium=email&utm_source=footer#!msg/vcap-dev/B1W6_vO0oyo/84X1eAtFsKoJ,
David Lee said "...As for multiline output, we should have fixed this a
couple of builds back...", I wonder what was really fixed related to
multiline output at that time.

Thanks.

George.