tonywagner/EPlusTV

[Request] Update logging mechanism to structured events

Opened this issue · 0 comments

I've been troubleshooting noisy devices my network recently and discovered that EPlusTV is a contributing factor due to my logging set up.

The container writes multi-line request/response debug dumps to stdout (example below). I ship logs via Docker’s gelf logging driver to Graylog (GELF TCP). Each newline is treated as a separate log event, so one HTTP request is fragmented into 20–40 events. This inflates ingest, breaks per-request context, and makes alerting/noise control hard.

Example (one request split into many events):

_header: 'GET /api/v1/tokens/authn?... HTTP/1.1\r\n' +
'Accept: application/json, text/plain, */*\r\n' +
'Authorization: GET requestor_id=... signature=' +
'Content-Type: application/json\r\n' +
...
path: '/api/v1/tokens/authn?...',
method: 'GET',
host: 'api.auth.adobe.com',
protocol: 'https:',
...

Why it happens

  • Docker’s json-file/gelf drivers frame records by newline when reading stdout/stderr.
  • Graylog cannot merge separate messages back together (pipelines don’t “join” events).
  • GELF supports chunking of one big message, but that is not reassembly of multiple lines.

Request

Is it possible to emit one structured, single-line log event per HTTP request (JSON), with escaped newlines inside the JSON if needed?

Thanks for all of your work on this project!