search

wellcomecollection / platform

Wellcome Collection Digital Platform
https://developers.wellcomecollection.org/
MIT License
48 stars 10 forks source link

Tidy dotnetcore logging messages sent to Elastic #4606

Open donaldgray opened 4 years ago

donaldgray commented 4 years ago

Multiline log entries in Elastic from dotnetcore applications are being treated as separate log entries (e.g. 4 lines = 4 separate messages).

I have encountered this before and it was a case of changing the output format of logs.

image

alexwlchan commented 4 years ago

This is something we want for the Scala apps too – so if you can provide pointers to how to do this, we'd be interested!

https://github.com/wellcomecollection/platform/issues/4546

donaldgray commented 4 years ago

Found some docs I had from previously handling this, which was slightly different as it was using Filebeat rather than Fluentbit but the same premise seems to stand.

I recall configuring app logs to adhere to a predefined format but I'd forgotten the need to configure Filebeat/Fluentbit to look for that "predefined format" and treat that as multiline. I think we'd need to make a change to the Wellcome/fluentbit image to contain this config (see https://coralogix.com/log-analytics-blog/parsing-multiline-logs-the-complete-guide/ and https://stackoverflow.com/questions/51645296/fluentbit-with-mycat-multiline-parsing).

cc/ @alexwlchan

tomcrane commented 3 years ago

Leave open but take off critical path.