Using Sidecars to have a multiline ouptut from GELF input

[allexandre (alex)]

Hello,

I receive logs from docker containers using the native dual logging option with a GELF output that comes with the last versions of docker. I would like to join some of these messages which were multiline at the beginning but are then fragmented by the docker output (seems that there is no docker solution to handle that). Before I was using logspout which was giving me the option to have some multiline function using a regex.

I was wondering if I could do something similar with the sidecar function of Graylog, I tried a bit but didn’t find anything related to a multiline function (which apparently existed in the previous versions of Graylog, reading some old messages on the web.)

Thanks by advance

[gsmith]

Hello && Welcome

I might be able to assist you. In this forum a couple community members had same issue.

@allexandre

I was wondering if I could do something similar with the sidecar function of Graylog,

One solution was using FileBeat /w GL Sidecar.

FileBeat-Multiline-Examples

Once you have the sidecar install the rest will be configured through the Web UI.

Here is another post of using multiline configuration with file beat. perhaps that might get you started.

Sidecar Multiline config

Hi! I’ve been working on a workaround for the limitations of the pipeline-grok in terms of multiline messages and I’ve successfully come up with a somewhat hacky solution that at least works in the pipeline simulator. However, as it seems, my Beats sidecar is not even transmitting the multiline messages to GrayLog for further processing, even when disabling all my pipelines and filters, Beats will not send any of the multiline java exceptions I throw at it into GrayLog. My Beats config looks …

Depending on what version your using you can use a Collector as shown below.

We do have TAG’s for Multi-line they may help in search as shown below.

Hope that helps