Reconstruct multiline docker logs by default

A recombine operator for OTel logs collection to reconstruct multiline logs on docker engine
signalfx · Jun 22, 2022 · 9445a4b · 9445a4b
1 parent ac82f49
commit 9445a4b
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 0 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,6 +4,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ## Unreleased
 
+### Added
+
+- A recombine operator for OTel logs collection to reconstruct multiline logs on docker engine (#465)
+
 ### Changed
 
 - Scrape /proc/self/mountinfo in agent pods to avoid incorrect stat attempts (#467)

diff --git a/helm-charts/splunk-otel-collector/templates/config/_otel-agent.tpl b/helm-charts/splunk-otel-collector/templates/config/_otel-agent.tpl
@@ -306,6 +306,12 @@ receivers:
         timestamp:
           parse_from: attributes.time
           layout: '%Y-%m-%dT%H:%M:%S.%LZ'
+      - type: recombine
+        id: docker-recombine
+        output: handle_empty_log
+        combine_field: attributes.log
+        source_identifier: attributes["log.file.path"]
+        is_last_entry: attributes.log endsWith "\n"
       {{- end }}
       - type: add
         id: handle_empty_log