Multiline log support based on regular expressions from pod annotations about fluentd-k8s

[sorend]

Hi. Thanks for the positive feedback.

The configuration in the article presents a multi-line annotation on the pods, but you can extend the configuration to each of the type of log you want, for example you can have log4j, JSON and default logging attributes on your pods. At my workplace we have opted for only multi-line or not, where the multi-line pattern matches common Java logging frameworks. There are some who use JSON which is simply "not multi-line" where each log statement must be a single line of JSON Do note that all containers within the Pod must be logging in the same format, if you want to extend on a container basis, then the solution is more complex (but doable).

How I see it a dynamic regex is not possible with the current "concat" plugin in fluentd, as the regex is complied at configuration time. You'd need to find another plugin or roll a fork of concat for yourself.

Hope it answers your question for going forward.

BR,
Søren

[umarkhan17]

we are creating a centralize logging system, where multiple microservices belonging to different projects co-exist with each project having their own logging patterns. What we are trying to do is, pass annotations for regex on the pod, and somehow concatenate multiple lines based on regex that we receive from Kubernetes_metadata, we are having 1 container per pod, some services have a proxy sidecar, but those can be ignored.

One idea is to parse multiline logs in a json and forward as-is via fluentD, which i support, but that will require efforts from the dev team.

Please suggest any other ideas.

I am relatively new to working with FluentD.

[sorend]

As mentioned, the regex is not dynamic in the "concat" module. You'd have to roll your own concat fork where it is dynamic, then you can evaluate the namespace/pod's regex when multiline splitting.

BR,
Soren