Skip to content

Commit 9000ded

Browse files
committed
Adds documentation about multi-line
Fixes #59
1 parent 4d0b405 commit 9000ded

File tree

1 file changed

+14
-4
lines changed

1 file changed

+14
-4
lines changed

README.md

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ Join the #plugin-systemd channel on the [Fluentd Slack](http://slack.fluentd.org
2222
| 0.0.x | ~> 0.12.0 | 2 | >= 1.9 |
2323

2424
* The 0.x.x series is developed from this branch (master)
25-
* The 0.0.x series (compatible with fluentd v0.12, and td-agent 2) is developed on the [0.0.x branch](https://github.com/reevoo/fluent-plugin-systemd/tree/0.0.x)
25+
* The 0.0.x series (compatible with fluentd v0.12, and td-agent 2) is maintained on the [0.0.x branch](https://github.com/reevoo/fluent-plugin-systemd/tree/0.0.x)
2626
* The next version is currently under development on the [1.0.0 branch](https://github.com/reevoo/fluent-plugin-systemd/tree/1.0.0) it's progress is tracked [here](https://github.com/reevoo/fluent-plugin-systemd/issues/53)
2727

2828
## Installation
@@ -86,11 +86,11 @@ Configuration for a [storage plugin](http://docs.fluentd.org/v0.14/articles/stor
8686
**`read_from_head`**
8787

8888
If true reads all available journal from head, otherwise starts reading from tail,
89-
ignored if pos file exists (and is valid). Defaults to false.
89+
ignored if cursor exists in storage (and is valid). Defaults to false.
9090

9191
**`entry`**
9292

93-
Optional configuration for an embeded systemd entry filter. See the [Filter Plugin Configuration](#filter-plugin-configuration) for config reference.
93+
Optional configuration for an embedded systemd entry filter. See the [Filter Plugin Configuration](#filter-plugin-configuration) for config reference.
9494

9595
**`tag`**
9696

@@ -166,14 +166,24 @@ The resulting entry using the above sample configuration:
166166

167167
## Common Issues
168168

169-
> ### When I look at fluentd logs, everything looks fine but no journal logs are read
169+
> ### When I look at fluentd logs, everything looks fine but no journal logs are read ?
170170
171171
This is commonly caused when the user running fluentd does not have the correct permissions
172172
to read the systemd journal.
173173

174174
According to the [systemd documentation](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html):
175175
> Journal files are, by default, owned and readable by the "systemd-journal" system group but are not writable. Adding a user to this group thus enables her/him to read the journal files.
176176
177+
> ### How can I deal with multi-line logs ?
178+
179+
Ideally you want to ensure that your logs are saved to the systemd journal as a single entry regardless of how many lines they span.
180+
181+
It is possible for applications to naively support this (but only if they have tight integration with systemd it seems) see: https://github.com/systemd/systemd/issues/5188.
182+
183+
Typically you would not be able to this, so another way is to configure your logger to replace newline characters with something else. See this blog post for an example configuring a Java logging library to do this https://fabianlee.org/2018/03/09/java-collapsing-multiline-stack-traces-into-a-single-log-event-using-spring-backed-by-logback-or-log4j2/
184+
185+
Another strategy would be to use a plugin like [fluent-plugin-concat](https://github.com/fluent-plugins-nursery/fluent-plugin-concat) to combine multi line logs into a single event, this is more tricky though because you need to be able to identify the first and last lines of a multi line message with a regex.
186+
177187

178188
## Dependencies
179189

0 commit comments

Comments
 (0)