Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

One Extra Parser for All Lines in a Multiline Log #1261

Closed
Kirchen99 opened this issue Apr 8, 2019 · 1 comment
Closed

One Extra Parser for All Lines in a Multiline Log #1261

Kirchen99 opened this issue Apr 8, 2019 · 1 comment

Comments

@Kirchen99
Copy link

Is your feature request related to a problem? Please describe.
This is our config of tail plugin for multiline logs:

    [INPUT]
        Name             tail
        Path             /var/log/containers/*multilin-log*.log
        Multiline        On
        Parser_Firstline multiline
	Parser_1         docker
        Tag              kube.*
        Refresh_Interval 5
        Skip_Long_Lines  false
        Mem_Buf_Limit    5MB

    [PARSER]
        Name        multiline
        Format      regex
        Regex       ^.*[*]{3}(?<appname>.*)[*]{2}(\\*\")*(?<apptime>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})[^\[]*\[(?<appthread>[a-z.A-Z_0-9-]*)]\s*(?<loglevel>[A-Z]{4,6}).*\[(?<appline>.*)\]\s*[-]\s*message:(?<message>.*\s*\\n)(.*\s*)*$

    [PARSER]
        Name        docker
        Format      json
        Time_Keep    Off
        Time_Key    time
        Time_Format %Y-%m-%dT%H:%M:%S.%L
        Decode_Field_As escaped log

It works only for two-line logs. And for Logs more than two lines, for example four lines, this config does not work:

    [INPUT]
        Name             tail
        Path             /var/log/containers/*multilin-log*.log
        Multiline        On
        Parser_Firstline multiline
	Parser_1         docker
	Parser_2         docker
	Parser_3         docker
	Parser_4         docker
        Tag              kube.*
        Refresh_Interval 5
        Skip_Long_Lines  false
        Mem_Buf_Limit    5MB


Describe the solution you'd like
A single extra parser works for all following multiline entries.

Additional context
Our application is running on kubernets. We have multiline logs in docker format and we want to have a parser to discover multiline messages and compose the outgoing messages.

@edsiper
Copy link
Member

edsiper commented Jul 20, 2021

Multiline Update

As part of Fluent Bit v1.8, we have released a new Multiline core functionality. This new big feature allows you to configure new [MULTILINE_PARSER]s that support multi formats/auto-detection, new multiline mode on Tail plugin, and also on v1.8.2 (to be released on July 20th, 2021) a new Multiline Filter.

For now, you can take at the following documentation resources:

Documentation pages now point to complete config examples that are available on our repository.

Thanks everyone for supporting this!

@edsiper edsiper closed this as completed Jul 20, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants