Yet another request for improved multi line log message handling. Is there
any update from the LAMB team on plans to improve this problem? There have
been several proposed solutions but I'm not aware of anything actually
making it into the LAMB tracker. It would be great if we could hear from
Erik on this issue. Does the LAMB team believe it is not an issue? Are
there plans to improve this situation? Whatever the perspective lets
discuss it as a community and see if there are any options better than the
current. I'd really like to see something turned into a tracker issue if
there are better options.
Mike
[0]
http://lists.cloudfoundry.org/pipermail/cf-dev/2015-June/000423.html[1]
http://lists.cloudfoundry.org/pipermail/cf-dev/2015-May/000083.html[2]
https://groups.google.com/a/cloudfoundry.org/forum/?utm_medium=email&utm_source=footer#!msg/vcap-dev/B1W6_vO0oyo/84X1eAtFsKoJ
On Mon, Jul 27, 2015 at 9:47 AM, Simon Johansson <simon(a)simonjohansson.com>
wrote:
This is a tricky one. Especially if you have more than one logstash
machine doing filtering as they will do filtering independently of each
other as the events come in.
The reason why CF adds a timestamp to each line is because how syslog
works, where each line is its own even.
What we tend to do in my company is to log this kind of stuff via GELF or
with Sentry.
On Mon, Jul 27, 2015 at 5:41 PM, Steve Wall <stevewallone(a)gmail.com>
wrote:
Hello,
We are sending CF logs message to an ELK stack. Multiline logs message
are broken out into several log messages in Logstash. One end per line of
the multiline log message. This is problematic when stack traces dumped to
the log. Each line of the stack trace is translated into a log message.
Trying to view this through Kibana is nearly impossible. Logstash provides
a Grok feature allowing for the manipulation of the log messages. One
common solution is to create a Grok filter that using a timestamp to
indicate when a log entry starts and to combine all lines until the next
timestamp into one log message. The problem is that CF adds a timestamp to
every line. Has anyone come up with a good Grok expression to handle
multiline log message coming out of CF?
Thanks!
Steve
_______________________________________________
cf-dev mailing list
cf-dev(a)lists.cloudfoundry.org
https://lists.cloudfoundry.org/mailman/listinfo/cf-dev
_______________________________________________
cf-dev mailing list
cf-dev(a)lists.cloudfoundry.org
https://lists.cloudfoundry.org/mailman/listinfo/cf-dev
