fluentbit reporting each line of the java stacktrace log as new log event fluentbit reporting each line of the java stacktrace log as new log event kubernetes kubernetes

fluentbit reporting each line of the java stacktrace log as new log event


According to fluentd documentation:

Additional Step 2: Concatenate Multiple Lines Log Messages

The application log is stored in the log field of the record. You can concatenate these logs by using fluent-plugin-concat filter before sending it to the destinations.

<filter docker.**>  @type concat  key log  stream_identity_key container_id  multiline_start_regexp /^-e:2:in `\/'/  multiline_end_regexp /^-e:4:in/</filter>

Original Events:

2016-04-13 14:45:55 +0900 docker.28cf38e21204: {"container_id":"28cf38e212042225f5f80a56fac08f34c8f0b235e738900c4e0abcf39253a702","container_name":"/romantic_dubinsky","source":"stdout","log":"-e:2:in `/'"}2016-04-13 14:45:55 +0900 docker.28cf38e21204: {"source":"stdout","log":"-e:2:in `do_division_by_zero'","container_id":"28cf38e212042225f5f80a56fac08f34c8f0b235e738900c4e0abcf39253a702","container_name":"/romantic_dubinsky"}2016-04-13 14:45:55 +0900 docker.28cf38e21204: {"source":"stdout","log":"-e:4:in `<main>'","container_id":"28cf38e212042225f5f80a56fac08f34c8f0b235e738900c4e0abcf39253a702","container_name":"/romantic_dubinsky"}

Filtered Events:

2016-04-13 14:45:55 +0900 docker.28cf38e21204: {"container_id":"28cf38e212042225f5f80a56fac08f34c8f0b235e738900c4e0abcf39253a702","container_name":"/romantic_dubinsky","source":"stdout","log":"-e:2:in `/'\n-e:2:in `do_division_by_zero'\n-e:4:in `<main>'"}

If the logs are typical stacktraces, consider usingdetect-exceptionsplugin instead.