You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem? Please describe.
This is our config of tail plugin for multiline logs:
[INPUT]
Name tail
Path /var/log/containers/*multilin-log*.log
Multiline On
Parser_Firstline multiline
Parser_1 docker
Tag kube.*
Refresh_Interval 5
Skip_Long_Lines false
Mem_Buf_Limit 5MB
[PARSER]
Name multiline
Format regex
Regex ^.*[*]{3}(?<appname>.*)[*]{2}(\\*\")*(?<apptime>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})[^\[]*\[(?<appthread>[a-z.A-Z_0-9-]*)]\s*(?<loglevel>[A-Z]{4,6}).*\[(?<appline>.*)\]\s*[-]\s*message:(?<message>.*\s*\\n)(.*\s*)*$
[PARSER]
Name docker
Format json
Time_Keep Off
Time_Key time
Time_Format %Y-%m-%dT%H:%M:%S.%L
Decode_Field_As escaped log
It works only for two-line logs. And for Logs more than two lines, for example four lines, this config does not work:
[INPUT]
Name tail
Path /var/log/containers/*multilin-log*.log
Multiline On
Parser_Firstline multiline
Parser_1 docker
Parser_2 docker
Parser_3 docker
Parser_4 docker
Tag kube.*
Refresh_Interval 5
Skip_Long_Lines false
Mem_Buf_Limit 5MB
Describe the solution you'd like
A single extra parser works for all following multiline entries.
Additional context
Our application is running on kubernets. We have multiline logs in docker format and we want to have a parser to discover multiline messages and compose the outgoing messages.
The text was updated successfully, but these errors were encountered:
As part of Fluent Bit v1.8, we have released a new Multiline core functionality. This new big feature allows you to configure new [MULTILINE_PARSER]s that support multi formats/auto-detection, new multiline mode on Tail plugin, and also on v1.8.2 (to be released on July 20th, 2021) a new Multiline Filter.
For now, you can take at the following documentation resources:
Is your feature request related to a problem? Please describe.
This is our config of tail plugin for multiline logs:
It works only for two-line logs. And for Logs more than two lines, for example four lines, this config does not work:
Describe the solution you'd like
A single extra parser works for all following multiline entries.
Additional context
Our application is running on kubernets. We have multiline logs in docker format and we want to have a parser to discover multiline messages and compose the outgoing messages.
The text was updated successfully, but these errors were encountered: