Fluentd: manage multiline log pattern

Actual Fluentd config doesn't manage multiline log pattern like:

2017-08-16 21:41:03.097 7 WARNING oslo_config.cfg [-] Option "firewall_driver" from group "DEFAULT" is deprecated for removal (
nova-network is deprecated, as are any related configuration options.
). Its value may be silently ignored in the future.

This log will generate 1 Fluentd event for each line (in previous
example 3 events).
This is really a wrong behaviour and made Kibana interface not friendly.
This patch uses a multiline parser.

Change-Id: Iee337645d1dc42876ec79be08ee3715f11a53d87
Closes-Bug: #1711399
This commit is contained in:
Bertrand Lallau 2017-08-17 18:05:20 +02:00 committed by Bertrand Lallau
parent eab91d4288
commit 38a6d30411
3 changed files with 6 additions and 8 deletions

View File

@ -60,7 +60,6 @@
with_items:
- "apache_access"
- "wsgi_access"
- "wsgi_python"
notify:
- Restart fluentd container

View File

@ -45,5 +45,10 @@
"/var/log/kolla/*/*-error.log"]
pos_file /var/run/{{ fluentd_dir }}/kolla-openstack.pos
tag kolla.*
format /^(?<message>.*)$/
format multiline
format_firstline /^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3} \d+ \S+ \S+ \[(req-\S+ \S+ \S+ \S+ \S+ \S+|-)\]/
format1 /^(?<Timestamp>\S+ \S+) (?<Pid>\d+) (?<log_level>\S+) (?<python_module>\S+) (\[(req-(?<request_id>\S+) (?<user_id>\S+) (?<tenant_id>\S+) (?<domain_id>\S+) (?<user_domain>\S+) (?<project_domain>\S+)|-)\])? (?<Payload>.*)?$/
time_key Timestamp
time_format %F %T.%L
ignore_repeated_permission_error true
</source>

View File

@ -64,12 +64,6 @@
"dest": "{{ fluentd_dir }}/format/wsgi_access.conf",
"owner": "{{ fluentd_user }}",
"perm": "0600"
},
{
"source": "{{ container_config_directory }}/format/wsgi_python.conf",
"dest": "{{ fluentd_dir }}/format/wsgi_python.conf",
"owner": "{{ fluentd_user }}",
"perm": "0600"
},{% if enable_elasticsearch | bool or
( elasticsearch_address != kolla_internal_vip_address ) | bool %}
{