Options to parse Syslog messages containing linebreaks

J.Huchtktter — Wed, 01 Jul 2026 15:08:00 GMT

Hello everyone!

I am facing a problem and hope someone can provide me with answers I have yet to find.

I am parsing syslog data into XSIAM, from a certain kind of our systems.
One of the entries in the original data for one of these systems may contain a linebreak (\n).

As this linebreak is not (properly?) escaped, this breaks the original message into two.
Fictionary example:

// original message
<42>1 2026-07-01T12:00:00.000Z host6789  - - - timestamp="1782928800" msg="auth failed" name="TestFarm\nServer6789"  user="test" action="login"

// _raw_log msgs in XSIAM:
<42>1 2026-07-01T12:00:00.000Z host6789  - - - timestamp="1782928800" msg="auth failed" name="TestFarm

Server6789"  user="test" action="login"

I would like to resolve this in XSIAM.

What I would want to do is artificially reconnect the two messages in the parsing rule; either by identifying that the current line is a secondary part and querying the one before and reconnecting
or, even better, by identifying the current line is the start of a broken message and querying / adding the next line to it.

Is there any way to do this? Or to handle linebreaks in any other way once the syslog hits XSIAM?

topic Options to parse Syslog messages containing linebreaks in General Topics

Options to parse Syslog messages containing linebreaks