# Process multiline logs from multiple docker images (multiple hosts)

**URL:** <https://discuss.elastic.co/t/process-multiline-logs-from-multiple-docker-images-multiple-hosts/105767>\
**Category:** Logstash\
**Created:** [October 30, 2017, 2:02pm UTC](https://discuss.elastic.co/t/process-multiline-logs-from-multiple-docker-images-multiple-hosts/105767 "2017-10-30T14:02:37Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![rchumarin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rchumarin/32/23456_2.png) [@rchumarin](https://discuss.elastic.co/u/rchumarin)\
**Post date:** [October 30, 2017, 2:02pm UTC](https://discuss.elastic.co/t/process-multiline-logs-from-multiple-docker-images-multiple-hosts/105767/1 "2017-10-30T14:02:37Z")

</div>

How to configure ELK to display one string per printstacktrace Exception, that it does not lead to a mixture of streams and corrupted event data (safe threads).

Now stacktrace in Kibana is splitted into multiple lines.  
My Logstash conf:  
input {  
gelf {}  
}  
output {  
elasticsearch {  
hosts =\> ["elasticsearch"]  
index =\> "myApplication-%{+YYYY.MM.dd}"  
}  
stdout { }  
}

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [October 30, 2017, 6:19pm UTC](https://discuss.elastic.co/t/process-multiline-logs-from-multiple-docker-images-multiple-hosts/105767/2 "2017-10-30T18:19:42Z")

</div>

The general recommendation is to perform any kind of multiline processing as close to the source as possible. What does you ingest process look like? What collects the data in the first place?

---

<div class="post-metadata">

**Author:** ![rchumarin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rchumarin/32/23456_2.png) [@rchumarin](https://discuss.elastic.co/u/rchumarin)\
**Post date:** [October 31, 2017, 7:28am UTC](https://discuss.elastic.co/t/process-multiline-logs-from-multiple-docker-images-multiple-hosts/105767/3 "2017-10-31T07:28:31Z")

</div>

My applications run inside five container dockers and send logs to stdout. GELF driver in the docker redirects these messages to logstash.  
I found this article [https://github.com/elastic/logstash/issues/4308](https://github.com/elastic/logstash/issues/4308)  
This article did not help me.  
How can this problem be solved?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [October 31, 2017, 9:24am UTC](https://discuss.elastic.co/t/process-multiline-logs-from-multiple-docker-images-multiple-hosts/105767/4 "2017-10-31T09:24:28Z")

</div>

Then ideally the gelf driver should handle multi line processing, but I am not familiar with this.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 28, 2017, 9:24am UTC](https://discuss.elastic.co/t/process-multiline-logs-from-multiple-docker-images-multiple-hosts/105767/5 "2017-11-28T09:24:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.