I deploy filebeat to openshift 3.11 by daemonset .The log format is json like this below:
{"log":"\u0009at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.invokeJoinpoint(CglibAopProxy.java:746)\n","stream":"stderr","time":"2021-09-18T05:57:04.787203348Z"}
{"log":"\u0009at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:163)\n","stream":"stderr","time":"2021-09-18T05:57:04.787237471Z"}
{"log":"\u0009at org.springframework.aop.aspectj.MethodInvocationProceedingJoinPoint.proceed(MethodInvocationProceedingJoinPoint.java:88)\n","stream":"stderr","time":"2021-09-18T05:57:04.787262424Z"}
and my config is below：
filebeat.config:
inputs:
# Mounted filebeat-inputs configmap:
path: ${path.config}/inputs.d/.yml
# Reload inputs configs as they change:
reload.enabled: false
modules:
path: ${path.config}/modules.d/.yml
# Reload module configs as they change:
reload.enabled: false
Uncommnet this part and remove filebeat.config.inputs when running in Openshift and cri-o
filebeat.autodiscover:
providers:
- type: kubernetes
include_pod_uid: true
hints.enabled: true
templates:
- condition.regexp:
kubernetes.container.name: '.+'
config:
- type: docker
containers:
path: "/var/log/pods/*${data.kubernetes.pod.uid}/"
ids:
- "${data.kubernetes.container.name}"
multiline:
pattern: '^[[0-9]{4}-[0-9]{2}-[0-9]{2}'
negate: true
match: after
json:
message_key: log
To enable hints based autodiscover, remove filebeat.config.inputs configuration and uncomment this:
#filebeat.autodiscover:
providers:
- type: kubernetes
hints.enabled: true
processors:
- add_cloud_metadata:
as you know，multiline can't work。
Is there some config need to modify？
thanks a lot