Search code examples
openshiftfluentdefk

OpenShift Logging: How do I make Kibana group lines of a stack trace into one record?


Context

I have the Red Hat OpenShift Logging Operator installed in a cluster, explained on this page. This is basically an EFK stack (ElasticSearch, Fluentd, Kibana). Normally with Fluentd you can configure many plugins and hundreds of parameters, but as you can see on this OpenShift page there are only 9 Fluentd parameters available (all chunk-related) because the logging stack is packaged as a Red Hat Operator. Adding custom configuration is not an option for me because it is unsupported and won't receive updates from RedHat.

Problem

When an application produces a stack trace after an error, Kibana shows 1 line of the stack trace per record 💀. I need the whole stack trace in 1 record. This is possible with the Fluentd multiline plugin but this is not a supported parameter with the Red Hat OpenShift Logging Operator (which uses Fluentd).

What are my options for grouping stack trace lines into one Kibana record, aside from installing a new/standalone logging stack?


Solution

  • There seems to be a supported solution now: Multiline logs in OpenShift 4 with ClusterLogForwarder API