[chef] Re: Re: Parsing Chef's Multiline Output

[Greg Zapp < >]

Hi Zac,

I've looked at the multi-line logstash filter's source and it appears to behave like the nxlog multi-line support;  that is the current event is "pending" until another non-matching event comes through to knock it out.  This is sub-optimal for me.  Without adding a hint of some fashion to the actual logs I can't see a way to have a multi-line event ejected as soon as it's been completed.

-Greg

On Tue, Mar 4, 2014 at 4:18 AM, Zac Stevens < " target="_blank"> > wrote:

On Sun, Mar 2, 2014 at 11:46 PM, Greg Zapp < " target="_blank"> > wrote:

I would like to know if anyone is dealing with Chef's multiline output when shipping to something like logstash->elasticsearch.  Currently Chef does not delineate log entries when they span multiple lines.  I'm considering monkey patching the logger to add a frame around the log entries but I'm not sure where the best place to do this is?  Ideally I would get it implemented before chef makes a single log entry...

When I've done this in the past, I've just used Logstash's multiline filter to collapse lines that don't begin with a datestamp in square brackets (as that's reliably at the beginning of every Chef log line).

Zac