Различия

Показаны различия между двумя версиями страницы.

--- software:monitoring:fluent-bit:multiline [2025/11/25 23:19] – удалено - внешнее изменение (Дата неизвестна) 127.0.0.1
+++ software:monitoring:fluent-bit:multiline [2025/11/25 23:19] (текущий) – ↷ Страница перемещена из software:fluent-bit-loki-grafana:fluent-bit:multiline в software:monitoring:fluent-bit:multiline mirocow
@@ Строка 1: / Строка 1: @@
+====== Обработка многострочных логов ======
+=== fluent-bit.conf ===
+<code ini>
+[SERVICE]
+    flush        1
+    log_level    info
+    parsers_file parsers_multiline.conf
+[INPUT]
+    name             tail
+    path             test.log
+    read_from_head   true
+    multiline.parser multiline-regex-test
+[FILTER]
+    name             parser
+    match            *
+    key_name         log
+    parser           named-capture-test
+[OUTPUT]
+    name             stdout
+    match            *
+</code>
+=== parsers_multiline.conf ===
+<code ini>
+[MULTILINE_PARSER]
+    name          multiline-regex-test
+    type          regex
+    flush_timeout 1000
+    #
+    # Regex rules for multiline parsing
+    # ---------------------------------
+    #
+    # configuration hints:
+    #
+    #  - first state always has the name: start_state
+    #  - every field in the rule must be inside double quotes
+    #
+    # rules |   state name  | regex pattern                  | next state
+    # ------|---------------|--------------------------------------------
+    rule      "start_state"   "/([a-zA-Z]+ \d+ \d+\:\d+\:\d+)(.*)/"  "cont"
+    rule      "cont"          "/^\s+at.*/"                     "cont"
+[PARSER]
+    Name named-capture-test
+    Format regex
+    Regex /^(?<date>[a-zA-Z]+ \d+ \d+\:\d+\:\d+) (?<message>.*)/m
+</code>
+=== test.log ===
+<code>
+single line...
+Dec 14 06:41:08 Exception in thread "main" java.lang.RuntimeException: Something has gone wrong, aborting!
+    at com.myproject.module.MyProject.badMethod(MyProject.java:22)
+    at com.myproject.module.MyProject.oneMoreMethod(MyProject.java:18)
+    at com.myproject.module.MyProject.anotherMethod(MyProject.java:14)
+    at com.myproject.module.MyProject.someMethod(MyProject.java:10)
+    at com.myproject.module.MyProject.main(MyProject.java:6)
+another line...
+</code>
+<code>
+$ fluent-bit -c fluent-bit.conf
+[0] tail.0: [1669160706.737650473, {"log"=>"single line...
+"}]
+[1] tail.0: [1669160706.737657687, {"date"=>"Dec 14 06:41:08", "message"=>"Exception in thread "main" java.lang.RuntimeException: Something has gone wrong, aborting!
+    at com.myproject.module.MyProject.badMethod(MyProject.java:22)
+    at com.myproject.module.MyProject.oneMoreMethod(MyProject.java:18)
+    at com.myproject.module.MyProject.anotherMethod(MyProject.java:14)
+    at com.myproject.module.MyProject.someMethod(MyProject.java:10)
+    at com.myproject.module.MyProject.main(MyProject.java:6)
+"}]
+[2] tail.0: [1669160706.737657687, {"log"=>"another line...
+"}]
+</code>