openshift/cluster-logging-operator

Application logs from containers are split into several documents

Closed this issue · 3 comments

barvhaim commented

We've installed the cluster logging with EFK stack on OpenShift 4.6, however, the logs that are coming from containers are displayed as split to several documents. How can we configure it to combine those related parts into a single log?

for example:

{ "x": 1 <--- doc 1
,"y": 2} <--- doc 2

to

{"x": 1, "y": 2}
jcantrill commented

CRIO splits logs based on its buffer size. The collector makes an effort to recombine them so there is no configuration change to be made. we are currently adding test cases to address the testing gap.

The concat plugin has a flush setting if it does not see a full message in the configured time. It may be that you see this issue do to the volume of logs flowing.

  • 👍1
jcantrill commented

Closing. Please reopen if there is additional need