Multi line logs not working

[marcelocastrillo]

I have configured log fordwards to support multiline logs, but the logs are not being sent to new relic. If I do it the regular way, with logs.yml the logs are sent but one log per line.

This is the configuration:

logs.yml :

logs:

• name: tomcat-erp2-logs fluentbit: config_file: /etc/newrelic-infra/logging.d/fluentbit.conf parsers_file: /etc/newrelic-infra/logging.d/parsers.conf

fluentbit.conf:

[INPUT] Name tail Path /home/tomcat/apache-tomcat-8.5.72/bin/test.log Path_Key filePath Key message Tag multiline_logs Multiline On Parser_Firstline MULTILINE_MATCH

parsers.conf

[PARSER] Name MULTILINE_MATCH Format regex Regex /(?[\d-]+ [\d:,]+) (?:[\w+] )?(?[A-Z]+)(?[\s\S]*)/

[marcelschlapfer]

Can you provide a sample of what the log messages look like? My assumption is that the regex probably doesn't match the message format correctly.

[marcelocastrillo]

I have the same configuration in another server, where the same app is running (with the same log4j configuration) and it works. The only difference is that the server where it works is running on debian, and this one is running on Centos ¿could that be a problem?

21/10/2022 01:25:10 ERROR en Clase: ImpCompras - MSN: could not extract ResultSet
 Exception.Class: GENERIC JDBC EXCEPTION
 Cause:org.postgresql.util.PSQLException: ERROR: Esta funcionalidad se encuentra temporalmente deshabilitada, por favor intente de nuevo mas tarde.
 ErrorCode: 0
 SQLException:org.postgresql.util.PSQLException: ERROR: Esta funcionalidad se encuentra temporalmente deshabilitada, por favor intente de nuevo mas tarde.
  Where: PL/pgSQL function f_get_tmp_det_necesidad_compra(date,date,bigint,bigint,bigint,character varying,character varying,bigint,bigint,bigint,bigint,bigint) line 9 at RAISE
 LastSQL:n/a
 StackTrace:
    at ar.com.dux.persistance.storedprocedures.implementations.ImpCompras.selectTmpDetNecesidadCompra(ImpCompras.java:92)
    at ar.com.dux.business.compras.implementations.ImpBusDetNecesidadCompra.selectTmpDetNecesidadCompra(ImpBusDetNecesidadCompra.java:41)
    at ar.com.dux.delegators.Compras.selectTmpDetNecesidadCompra(Compras.java:1060)
    at ar.com.dux.beans.compras.necesidadCompra.BBConsultaNecesidadCompraPorSucursal.actBtnConsultar(BBConsultaNecesidadCompraPorSucursal.java:93)
    at ar.com.dux.beans.compras.necesidadCompra.BBConsultaNecesidadCompraPorSucursal.<init>(BBConsultaNecesidadCompraPorSucursal.java:56)
    at ar.com.dux.jsf.filters.CacheFilter.doFilter(CacheFilter.java:27)
    at ar.com.dux.jsf.filters.SecurityFilter.conresultado(SecurityFilter.java:98)
    at ar.com.dux.jsf.filters.SecurityFilter.doFilter(SecurityFilter.java:83)

[marcelschlapfer]

What version of CentOS?

Also, just want to confirm that your regex looks like this: /(?<timestamp>[\d-]+ [\d:,]+) (?:\[\w+]\ )?(?<level>[A-Z]+)(?<message>[\s\S]*)/

[marcelocastrillo]

Centos version is 7. Is the regex incorrect? Because it is working on other servers.

[marcelschlapfer]

I tested your configuration on an Amazon Linux server and it works fine. CentOS 7 is supported by our Infra Agent. What version of the agent are you running? You could maybe also try with latest stand alone FluentBit agent to validate.

[danybmx]

Closing since no comments from Oct, 2022