New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Multiline codec pattern not working for gelf input #64
Comments
@fewknow Thanks for your feedback. Please note that the gelf does not make use of codecs. In fact, the GELF format is serialized in JSON so the gelf input simply deserialize the received JSON data - there is not point in supporting codecs for that input. Could you please share more details about what exactly you are trying to achieve and which field is part of a multi lines output that you are trying to consolidate back into a single event? |
@colinsurprenant I am trying to consolidate java logs coming from my docker containers. This is in aws on an ECS cluster. There is no support for log4j currently, but there is GELF support on ECS tasks. Currently I have this pumping logs to logstash and then to elasticsearch. The issue I am facing is a single log for every line of the log over GELF. Was hoping to help out my developers by collapsing the stack trace into a more desirable log once it gets to elasticsearch. Please let me know best way to do this. I know there is filebeat and a log4j plugin but this doesn't work well with our docker containers as they are a single PID process currenlty and would like to keep them this way. Any and all help is appreciated. Thanks |
I would suggest creating a feature request issue to explore the possibility of enabling codecs per your multi-line use-case but I don't see that happening in the short term unless the community pick it up. Alternatively, since this is more a usage question I would also suggest to bring it up in the forums https://discuss.elastic.co/c/logstash where it might reach a wider audience. |
hi @fewknow , Since "multiline" is not available as a filter, I wondered maybe if "aggregate" filter would be of any help ... didn't try ye though. |
(for the records, I switched from geld to firelens / fluentbit to solve this) |
Please post all product and debugging questions on our forum. Your questions will reach our wider community members there, and if we confirm that there is a bug, then we can open a new issue here.
For all general issues, please provide the following details for fast resolution:
Multiline is not working with gelf input.
The pattern is not being picked up.
I also see that it is setting the pattern as "^\t" fom "^\t"
Thank you for your time.
The text was updated successfully, but these errors were encountered: