fluentd multiline parser in parser filter fluentd multiline parser in parser filter kubernetes kubernetes

fluentd multiline parser in parser filter


I came recently to exactly the same issue and still couldn't find obvious solution so I had to figure it out myself. It is exactly as it is in doc - this parser you mentioned works only as Parser section in Input plugin ('in_tail' only). It doesn't work in filter plugin unfortunately.

But for me this plugin helped:https://github.com/fluent-plugins-nursery/fluent-plugin-concat

You just have to add one filter section above your main one where you do this concat, e.g. my example looks exactly like this (indicator of real new log is timestamp, if there is no timestamp it is always stacktrace of errors where the problem appears):

<filter XYZ.**>  @type concat  key log  multiline_start_regexp /\d{4}-\d{1,2}-\d{1,2}/</filter><filter>   # here the original filter</filter>