Process multiline logs from multiple docker images
- Dominant language
- Java
- Stars
- 14.9k
- Forks
- 3.5k
- Avg merge
- 19h 14m
- Merged PRs (30d)
- 63
Description
I run docker container with gelf driver and would like to collapse multiline logs in Logstash. My Logstash conf.
```
input {
gelf {}
}
filter{
multiline {
pattern => "^%{TIMESTAMP_ISO8601}"
negate => true
what => "previous"
source => "short_message"
}
}
output {
stdout { codec => rubydebug }
}
```
It works perfectly when I process logs from one docker container, but for two or more it does not work, because it collapse messages of both (or more) logs streams.
I would expect, that setting up multilining in input would solve the problem.
```
input {
gelf {
codec => multiline {
pattern => "^%{TIMESTAMP_ISO8601}"
negate => true
what => "previous"
}
}
```
but multilining does not work correctly with this set up (seems because of [bug](https://github.com/logstash-plugins/logstash-input-gelf/pull/18)). Any suggestions? Thanks.
I am using: Docker 1.9.1, Logstash 2.1
Contributor guide
Assessment
This issue has not been assessed yet.