Consuming multiline Docker logs via GELF UDP

Graylog Central (peer support)
1

So I’m currently running multiple Graylog colllectors under Docker, and telling Docker to use it’s GELF logging mechanize to dump it’s logs to our Greylog deployment (itself basically).

Only issue is all the Java stacktraces are mutliline so each line is getting submitted as an individual message. So one stacktrace can equal almost 30 messages. Is there any plugins, log4j2, GROK, etc etc to get each stacktrace into a single message?

Anyone run into this? Doing some basic Googling I’ve seen several people have run into this but no solution. Seems like it would be a common issue?

2

Hej @replicant0wnz

you can not merge messages with Graylog. You will need to submit the multiline message as single message to have that as single message in Graylog.

regards
Jan

3

you can use filebeat which supports multiline to read logs from files.

4

Either way it seems I can’t use the native Docker GELF driver. Seems the Docker team doesn’t want to support multi-line: