Aggregate method for kubernetes_logs

[GiannisKosm]

Hello everyone,
I was wondering whether i could aggregate the kubernetes_logs of /var/log/pod/../../0.log in source. I want at the produced json the message part to hold more than one entry. For example, these two entries, i want them both in the message of one json, and not different. Java splits the two lines even though the
ERROR 2024-12-03T10:53:16.259Z testAPI com.controller.CustomRestExceptionHandler Application - Error
2024-12-03T10:53:16.259Z org.springframework.security.access.AccessDeniedException: Access is denied

Best Regards,
Giannis

[jszwedko]

Hi @GiannisKosm ,

I think you could use the reduce transform to accomplish this. See an example of combining ruby exceptions: https://vector.dev/docs/reference/configuration/transforms/reduce/#examples-merge-ruby-exceptions

You'll want to make sure to set group_by to file to ensure that each file is reduced separately.