Multi line log events for kubernetes pods

[Vineeth Kiv]

How can I aggregate the log events to a single entry even though it is logged in multiple lines through application logger when docker is deployed to gcp kubernetes cluster.

For AWS we can use the date time format to identify the start of an event. What is the substitute in GCP.

Thanks.

[Matt Brown]

I believe the fluentd configuration used by the Stackdriver Logging addon is here: https://github.com/kubernetes/kubernetes/blob/c04fe8c27c9053a37face46abfebc45b9ac23dd7/cluster/addons/fluentd-gcp/fluentd-gcp-configmap.yaml#L108-L118, which I think uses this plugin https://github.com/GoogleCloudPlatform/fluent-plugin-detect-exceptions.

If you look at the code for the detect_exceptions plugin, it has rules for common formats in a number of languages: https://github.com/GoogleCloudPlatform/fluent-plugin-detect-exceptions/blob/8e5608209d9c2a8927b4531b2077f7057d65616c/lib/fluent/plugin/exception_detector.rb#L52-L130