How to collect multi-line logs like Java stack trace logs and ship it to ElasticSearch?

Right now all the logs that ship to Elasticsearch are single line,it’s hard to view stack trace logs in Kibana.
Is there any way to collect multi-line logs on Rancher?

At work we use a logging formatter that ouputs stacktraces on a single line with backslash n for line separation

HI, i cant add “parser” into the “edit as a form”

  @type multiline
  format_firstline /\d{4}-\d{1,2}-\d{1,2}/
  format1 /^(?<time>\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{1,2}:\d{1,2}) \[(?<thread>.*)\] (?<level>[^\s]+)(?<message>.*)/

How to configure rancher-logging to send correct java multi line format to elasticsearch?
Need help! Thank you so much!

1 Like