[Filebeat][K8S] How to process multiple types of logs (1 single + 2 different multiple lines) in one file?

Hello guys,
can anyone give me tip how to process multiple types of logs in one file for this usecase:
In the log file I have 3 types of log:

1) PHP-FPM Access log (is single-line)

10.102.0.141 -  25/Apr/2022:11:17:57 +0000 "GET /index.php" 200

%R - %u %t "%m %r" %s
https://www.php.net/manual/en/install.fpm.configuration.php

2) PHP-FPM Server log (which can be multline)

      [25-Apr-2022 09:35:00]  [pool www] pid 512 \n script_filename = /app/pub/index.php
      [0x00007f12f5217000] execute() /app/vendor/magento/framework/DB/Statement/Pdo/Mysql.php:91
      [0x00007f12f5216f90] Magento\Framework\DB\Statement\Pdo\{closure}() /app/vendor/magento/framework/DB/Statement/Pdo/Mysql.php:107
      [0x00007f12f5216eb0] tryExecute() /app/vendor/magento/framework/DB/Statement/Pdo/Mysql.php:92
      [0x00007f12f5216e10] _execute() /app/vendor/magento/zendframework1/library/Zend/Db/Statement.php:303
      ...
      [25-Apr-2022 09:35:00]  [pool www] ...

3) Application log (which can be multline)

2022-04-25T11:17:58+429 (522) D1: Source class "\Phalcon\Http\Message\Request" for "Phalcon\Http\Message\RequestFactory" generation does not exist....

The log file is read from file of kubernetes nodes by Filebeat agent. Is it possible to do that without sidecar container?

I'm thinking of logging in a container to multiple files and using sidecar container (Filebeat) to collect it.

We solved this situation by sidecars.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.