signalfx/splunk-otel-collector-chart

Multiline configuration not working as expected

xxPhuNguyenxx opened this issue · 1 comments

For values.yaml, below is our values.yaml for capturing this multiline. Can we define it by just the namespace or do we have to include podname as well?

logsCollection:
containers:
excludePaths: ["/var/log/pods/datadog_datadog-//.log"]
excludeAgentLogs: false
multilineConfigs:
- namespaceName:
value: splunk-otel
podName:
value: ocp4-onprem-sbx-splunk-otel-

useRegexp: true
firstEntryRegex: ^\d{4}-\d{2}-[0-9T]{3,5}:\d{2}:\d{2}.[0-9Z]{4}

Otel pod log example where we are expecting 2 events, but in splunk we're getting 9+ events:
2023-11-21T14:41:29.754Z error fileconsumer/file.go:168 Failed to open file {"kind": "receiver", "name": "filelog", "data_type": "logs", "component": "fileconsumer", "error": "open /var/log/pods/openshift-operators_poison-pill-ds-6mjpq_d9343015-2012-48bf-9b68-f8dc3b5238f0/manager/36569.log: no such file or directory"}
github.com/open-telemetry/opentelemetry-collector-contrib/pkg/stanza/fileconsumer.(*Manager).makeFingerprint
github.com/open-telemetry/opentelemetry-collector-contrib/pkg/stanza@v0.87.0/fileconsumer/file.go:168
github.com/open-telemetry/opentelemetry-collector-contrib/pkg/stanza/fileconsumer.(*Manager).makeReader
github.com/open-telemetry/opentelemetry-collector-contrib/pkg/stanza@v0.87.0/fileconsumer/file.go:204
github.com/open-telemetry/opentelemetry-collector-contrib/pkg/stanza/fileconsumer.(*Manager).consume
github.com/open-telemetry/opentelemetry-collector-contrib/pkg/stanza@v0.87.0/fileconsumer/file.go:127
github.com/open-telemetry/opentelemetry-collector-contrib/pkg/stanza/fileconsumer.(*Manager).poll
github.com/open-telemetry/opentelemetry-collector-contrib/pkg/stanza@v0.87.0/fileconsumer/file.go:120
github.com/open-telemetry/opentelemetry-collector-contrib/pkg/stanza/fileconsumer.(*Manager).startPoller.func1
github.com/open-telemetry/opentelemetry-collector-contrib/pkg/stanza@v0.87.0/fileconsumer/file.go:91
2023-11-21T14:46:32.754Z info fileconsumer/file.go:160 Started watching file {"kind": "receiver", "name": "filelog", "data_type": "logs", "component": "fileconsumer", "path": "/var/log/pods/openshift-operators_poison-pill-ds-6mjpq_d9343015-2012-48bf-9b68-f8dc3b5238f0/manager/36571.log"}

Sorry to hear you have difficulties applying different multiline patterns per namespace. Would you please open a support case to follow up? We can take it from there. Closing as we are phasing out github issues.