How to collect multi-line logs like Java stack trace logs and ship it to ElasticSearch?

Rancher 2.x
1

Right now all the logs that ship to Elasticsearch are single line,it’s hard to view stack trace logs in Kibana.
Is there any way to collect multi-line logs on Rancher?

2

At work we use a logging formatter that ouputs stacktraces on a single line with backslash n for line separation

3

HI, i cant add “parser” into the “edit as a form”

<parse>
  @type multiline
  format_firstline /\d{4}-\d{1,2}-\d{1,2}/
  format1 /^(?<time>\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{1,2}:\d{1,2}) \[(?<thread>.*)\] (?<level>[^\s]+)(?<message>.*)/
</parse>

How to configure rancher-logging to send correct java multi line format to elasticsearch?
Need help! Thank you so much!

1 Like