Support grouping partial lines from Docker's journald log driver #10114
Labels
containers
Related to containers use case
enhancement
Journalbeat
needs_team
Indicates that the issue/PR needs a Team:* label
Stalled
Describe the enhancement:
Docker's journald log driver (https://docs.docker.com/config/containers/logging/journald/) splits long log entries over multiple journald entries. If a message is being split, the driver at least helpfully annotates the journald entry with a CONTAINER_PARTIAL_MESSAGE:true flag.
This has been discussed here: https://github.com/mheese/journalbeat/issues/37 and a similar issue has been fixed in filebeats here: #6967.
It would be nice if journalbeats could look for this flag, and if present, group subsequent messages together into a single message prior to sending to the targeted output.
Describe a specific use case for the enhancement or feature:
Many folks use Docker and journald logging driver.
The text was updated successfully, but these errors were encountered: