Application logs from containers are split into several documents
barvhaim opened this issue · comments
We've installed the cluster logging with EFK stack on OpenShift 4.6, however, the logs that are coming from containers are displayed as split to several documents. How can we configure it to combine those related parts into a single log?
for example:
{ "x": 1 <--- doc 1
,"y": 2} <--- doc 2
to
{"x": 1, "y": 2}
CRIO splits logs based on its buffer size. The collector makes an effort to recombine them so there is no configuration change to be made. we are currently adding test cases to address the testing gap.
The concat plugin has a flush setting if it does not see a full message in the configured time. It may be that you see this issue do to the volume of logs flowing.
Closing. Please reopen if there is additional need