elastic / elastic/logstash

Process multiline logs from multiple docker images

Open
#4,308 28 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
14.9k
Forks
3.5k
Avg merge
19h 14m
Merged PRs (30d)
63

Description

I run docker container with gelf driver and would like to collapse multiline logs in Logstash. My Logstash conf.

```
input {
gelf {}
}
filter{
multiline {
pattern => "^%{TIMESTAMP_ISO8601}"
negate => true
what => "previous"
source => "short_message"
}
}
output {
stdout { codec => rubydebug }
}
```

It works perfectly when I process logs from one docker container, but for two or more it does not work, because it collapse messages of both (or more) logs streams.

I would expect, that setting up multilining in input would solve the problem.

```
input {
gelf {
codec => multiline {
pattern => "^%{TIMESTAMP_ISO8601}"
negate => true
what => "previous"
}
}
```

but multilining does not work correctly with this set up (seems because of [bug](https://github.com/logstash-plugins/logstash-input-gelf/pull/18)). Any suggestions? Thanks.

I am using: Docker 1.9.1, Logstash 2.1

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.