Log lines over 16KB are truncated about sumologic-kubernetes-collection

[arjunnayak]

Just found out about Docker_Mode in fluent-bit. Maybe it's worth pointing this out somewhere in documentation, or even a flag for the helm chart to enable Docker_Mode?

We just tested this on 0.11.0 and it seems to work well, although it breaks on 0.13.0 since multiline mode was enabled, and these 2 modes cannot be used together.

[vsinghal13]

Just found out about Docker_Mode in fluent-bit. Maybe it's worth pointing this out somewhere in documentation, or even a flag for the helm chart to enable Docker_Mode?

We just tested this on 0.11.0 and it seems to work well, although it breaks on 0.13.0 since multiline mode was enabled, and these 2 modes cannot be used together.

@arjunnayak Correct, as of now the Docker_Mode and the Multiline cannot be used together. One of the customers also experienced this issue and turned off the Multiline feature as they were confident that they won't have multiline logs. Even if you do have multiline logs, they will be spilt into multiple messages which is still better than loosing data .

[arjunnayak]

Sounds good, that's likely what we'll do as well. If there are no future plans to try to solve both problems (truncation & multiline support), then feel free to close the issue. It would be great to have both out of the box!

[vsinghal13]

@arjunnayak Documentation for the same has been added. Closing the issue .
https://github.com/SumoLogic/sumologic-kubernetes-collection/blob/master/deploy/docs/Best_Practices.md#log-lines-over-16kb-are-truncated