Timeout flush [dump an error event] when using Fluentd concat plugin

[Marco Pas]

Hi there,

i am testing a simple setup to concat multiple log events being the output of a docker container running a Java program.

The setup is very simple:

Java App (Docker) ----> FluentD (Docker) [output to console]

When I intentionally throw an error inside the Java App the logs are send to FluentD but on certain moments I am getting an error which I can not explain.

Error message:

2016-05-26 13:35:59 +0000 [warn]: dump an error event: error_class=Fluent::ConcatFilter::TimeoutError error="Timeout flush: ...... etc

My config:

<source>
  @type forward
  port 24224
  bind 0.0.0.0
</source>


<filter *.docker.*>
  @type concat
  key log
  stream_identity_key container_id
  multiline_start_regexp /^\S+/
  flush_interval 5s
</filter>


<match **>
    @type stdout
</match>

Any suggestion how this can be solved?

[Hoan Hoangphu]

did you solved it?

Vào 20:58:35 UTC+7 Thứ Năm, ngày 26 tháng 5 năm 2016, Marco Pas đã viết:

[Marco Pas]

Yep solved it using a plugin, the concat plugin.

sudo -u fluent gem install fluent-plugin-concat -v '2.0.0'

In the config i check on repeating data for example the spring boot log format.

    <filter springboot.**>

        @type concat

        key log

        stream_identity_key container_id

        multiline_start_regexp /^(\d{4})-(\d{2})-(\d{2}) (\d{2}):(\d{2}):(\d{2})[^\s]+/

        flush_interval 10s

        timeout_label @PROCESSDATA

    </filter>

Hope this helps. If needed i can share my config.

--
You received this message because you are subscribed to a topic in the Google Groups "Fluentd Google Group" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/fluentd/XvqjAENg-0g/unsubscribe.
To unsubscribe from this group and all its topics, send an email to fluentd+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

Marco Pas

[Jasmine Hegman]

To expound upon Marco's answer, one may be losing logs if they do not handle that @PROCESSDATA label!

Please see this github issue thread where they describe the following extra to cover this:

<filter **>

@type concat

key "message"

multiline_start_regexp "/^Start/"

flush_interval 5

timeout_label "@LASTLINE"

</filter>
<match **>

@type relabel

@label @NORMAL

</match>
<label @LASTLINE>

<match **>

@type relabel

@label @NORMAL

</match>

</label>
<label @NORMAL>

<match **>

@type stdout

</match>

</label>

The labels are a bit ornery if you are not already using them, but it beats losing logs.

To unsubscribe from this group and all its topics, send an email to fluentd+u...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

Marco Pas