-
Notifications
You must be signed in to change notification settings - Fork 183
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add support for multiline logs in CRI-O and containerd format #1449
Comments
@kkujawa-sumo Does this fix the compatibility issue with AKS 1.19.x? Thanks for your help! |
@justin-chizer Sorry for the late response. Do you mind explaining which exact issue do you have in mind here? |
@pmalek-sumo We're aware that there is a log limit for sumo of 64k, however we're seeing logs get truncated before getting anywhere near that limit. https://help.sumologic.com/05Search/Get-Started-with-Search/Search-Basics/Search-Large-Messages using the recommended filter of |
Hi @justin-chizer, As part of 2.2 https://github.com/SumoLogic/sumologic-kubernetes-collection/milestone/11 release we're going to bump the fluent-bit version to 1.8.8 (related PR: #1824) This should address the issue we're discussing here as @kkujawa-sumo described. |
FYI, I am using 2.1.6 and bumped the fluent-bit to 1.8.9 and it is not working. All logtags are still F and MULTILINE_PARSER rules are not working. |
@chrisc1122 The change mentioned in my previous comment had to be reverted since newer versions of fluent-bit (1.8+) proved to be flaky for us (in our e2e tests). We're still investigating this as this issues has a wider blast radius. |
My tests of the new multiline parser in Fluent Bit 1.8.11 showed that:
Moreover we need to remember that
and about the fact that there is following warning in documentation for Multiline filter
so it is important to extract multiline logs in input plugin, not in filter plugin. Currently in Fluent Bit documentation there is following information:
it means that we still need to observe changes in the new multiline parser. |
Related issue with multiline parser re-design discussion: fluent/fluent-bit#4309 |
Now multiline logs in CRI-O and containerd format are not well supported in Fluent Bit, see:
fluent/fluent-bit#1316
Fluent Bit is going to introduce generic multi-line support, targeted for 1.7.X release, see: fluent/fluent-bit#1316 (comment)
The text was updated successfully, but these errors were encountered: