fluent / fluent/fluent-bit

document multiline parsing by docker parser

Open
#10,212 10 comments 0 reactions 0 assignees View on GitHub
docs issue exempt-stale
Dominant language
C
Stars
8.1k
Forks
2k
Avg merge
4d 16h
Merged PRs (30d)
58

Description

## Bug Report

**Describe the bug**
I'm running applications in k8s, that log e.g. java stacktraces on multiple lines.
The [documentation](https://docs.fluentbit.io/manual/pipeline/inputs/tail) says you can use the tail parser with 'multiline.parser' set to '[docker](https://docs.fluentbit.io/manual/administration/configuring-fluent-bit/multiline-parsing)'.
But what does the 'docker' parser do with regards to multi lines? What does it consider a multi-line log?

when searching on the internet, I see other people adding an additional 'multiline' filter. But the [manual](https://docs.fluentbit.io/manual/pipeline/filters/multiline-stacktrace) says:

> If you wish to concatenate messages read from a log file, it is highly recommended to use the multiline support in the [Tail plugin](https://docs.fluentbit.io/manual/pipeline/inputs/tail#multiline-support) itself. This is because performing concatenation while reading the log file is more performant. Concatenating messages originally split by Docker or CRI container engines, is supported in the [Tail plugin](https://docs.fluentbit.io/manual/pipeline/inputs/tail#multiline-support).

So to me this seems like adding filters is not the way to go.

**Expected behavior**
Clear instructions how to set up multi-line parsing in combination with the docker parser and/or
clear description on what lines the docker parser can join, and when to use multiline filters instead and/or
clear description of the difference between docker/cri multiline capabilities and other multiline parsers/filters

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.