Expose combine_with option in multilineConfig section

[matthewmodestino]

Is your feature request related to a problem? Please describe.

When using multilineConfig in the helm chart, it defaults to using the filelog operator default option for combinie_with which is \n

This can cause extra whitespace/lines to be rendered in the Splunk back end, where what I actually want for some recombined logs is to set combine_with to ""

Describe the solution you'd like

Expose the option for combine_with in the multiline_config section.

Describe alternatives you've considered

To workaround this, I would have to grab the rendered router and recombine operators from the config map and move them to the extraOperators section in the helm chart instead.

Additional context

We had a similar experience in Splunk Connect for Kubernetes, and eventually exposed more of the concat plugin features to control these things in the helm chart as well.

https://github.com/splunk/splunk-connect-for-kubernetes/blob/a65f108f0e41b6ababf811be9217ae10f0f079ba/helm-chart/splunk-connect-for-kubernetes/values.yaml#L266

[matthewmodestino]

bump...

Ran into another situation where exposing more recombine operator options would have helped.

This time, max_batch_size of the filelog operator would have been much easier exposed as a part of the multilineConfig section, kinda like we did with the max_log_size.

splunk-otel-collector-chart/helm-charts/splunk-otel-collector/values.yaml

Line 581 in 97ecab9

maxRecombineLogSize: 1048576

Workaround again was to configure multilineConfig, take the config generated in configmap, then move it all to extraOperators section with the settings we wanted to set.

[github-actions]

This issue has been inactive for 60 days. It will be closed in 60 days if there is no activity. If this issue is still relevant, please leave a comment explaining why it is still relevant. Otherwise, please close it.

[matthewmodestino]

Still want this..