fluent / fluent/fluent-bit

in.tail + multiline.parser + Mem_Buf_Limit loses logs

Open
#8,353 1 comment 0 reactions 0 assignees View on GitHub
long-term troubleshooting work-in-process
Dominant language
C
Stars
8.1k
Forks
2k
Avg merge
4d 20h
Merged PRs (30d)
71

Description

## Bug Report

**Describe the bug**

This is similar to #3926 , but for the new multiline parsing mechanism.
multiline.parser + Mem_Buf_Limit loses logs when in.tail pauses.

**To Reproduce**

1. fluent-bit.conf:
```
[SERVICE]
Daemon Off
Parsers_File parsers.conf

[INPUT]
Name tail
Path /log/log.in
Read_from_Head true
Mem_Buf_Limit 512kb
exit_on_eof true
multiline.parser multi_log_line
Tag log.out

[FILTER]
name parser
Alias named_capture_parser
match log.out
Key_Name log
parser named-capture-multi_log_line
Preserve_Key Off
Reserve_Data On

[OUTPUT]
Name file
Match log.out
Path /log
Format plain
```
2. parsers.conf:
```
[MULTILINE_PARSER]
name multi_log_line
type regex
flush_timeout 2000
# rules | state name | regex pattern | next state
# ------|---------------|---------------------------------
rule "start_state" "/^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3} .*$/" "cont"
rule "cont" "/^\s.*/" "cont"
# It is not possible to get the time key from the body of the multiline message.
# However, it can be extracted and set as a new key by using a filter, see named-capture-selflog below.

[PARSER]
Name named-capture-multi_log_line
Format regex
Regex /^(?

**Expected behavior**
The output of the last command is empty; each multiline log record in the input file has a corresponding line in the output file.

**Actual behavior**
The output of the last command looks like this:
```
1109-{"time":"2021-01-01 00:00:01.109","message":"
1110:{"log":" continuation30\n continuation31\n
1111-{"time":"2021-01-01 00:00:01.111","message":"
--
2218-{"time":"2021-01-01 00:00:02.218","message":"
2219:{"log":" continuation70\n continuation71\n
2220-{"time":"2021-01-01 00:00:02.220","message":"
--
2773-{"time":"2021-01-01 00:00:02.773","message":"
2774:{"log":" continuation30\n continuation31\n
2775-{"time":"2021-01-01 00:00:02.775","message":"
--
4436-{"time":"2021-01-01 00:00:04.437","message":"
4437:{"log":" continuation30\n continuation31\n
4438-{"time":"2021-01-01 00:00:04.439","message":"
```

**Your Environment**
* Version used: 2.2.1
* Configuration: see above.
* Environment name and version: Docker version 24.0.7
* Operating System and version: Linux 6.6.9-arch1-1
* Filters and plugins: none

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.