Skip to content

Conversation

@eschabell
Copy link
Collaborator

@eschabell eschabell commented Dec 4, 2025

Update multiline parsing documentation based on fluent-bit source code:

Configuration updates:

  • Add missing ruby built-in multiline parser
  • Document additional type values: endswith and equal/eq
  • Add missing properties: negate and match_string
  • Fix flush_timeout default from 5s to 4s (matches source)
  • Fix multiline_buffer_limit default from 2MiB to 2MB
  • Clarify that KB/MB/GB and KiB/MiB/GiB suffixes are all interpreted as binary
  • Sort configuration properties table alphabetically

Add built-in parser examples section:

  • Add comprehensive examples for all 6 built-in parsers: cri, docker, go, java, python, ruby
  • Include YAML and classic configuration for each parser
  • Show input log samples and expected output after concatenation
  • Add subsection headers for better navigation

Fixes #2276.

Summary by CodeRabbit

  • Documentation
    • Added Ruby (after Python) to built-in multiline parsers and expanded parser examples across languages.
    • Expanded configurable parser options: flush_timeout, key_content, match_string, negate (default false); clarified rule is used only with regex.
    • Added parser types: regex, endswith, equal (eq).
    • Clarified memory buffering units (KB/MB/GB or KiB/MiB/GiB) and default buffer set to 2MB.

✏️ Tip: You can customize this high-level summary in your review settings.

…umentation with missing features and add examples

Update multiline parsing documentation based on fluent-bit source code:

Configuration updates:
- Add missing `ruby` built-in multiline parser
- Document additional type values: `endswith` and `equal`/`eq`
- Add missing properties: `negate` and `match_string`
- Fix `flush_timeout` default from 5s to 4s (matches source)
- Fix `multiline_buffer_limit` default from 2MiB to 2MB
- Clarify that KB/MB/GB and KiB/MiB/GiB suffixes are all interpreted as binary
- Sort configuration properties table alphabetically

Add built-in parser examples section:
- Add comprehensive examples for all 6 built-in parsers:
  cri, docker, go, java, python, ruby
- Include YAML and classic configuration for each parser
- Show input log samples and expected output after concatenation
- Add subsection headers for better navigation

Fixes fluent#2276.

Signed-off-by: Eric D. Schabell <eric@schabell.org>
@eschabell eschabell self-assigned this Dec 4, 2025
@eschabell eschabell added the 4.2.1 label Dec 4, 2025
@eschabell eschabell requested review from a team as code owners December 4, 2025 13:04
@coderabbitai
Copy link
Contributor

coderabbitai bot commented Dec 4, 2025

Warning

Rate limit exceeded

@eschabell has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 21 minutes and 36 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

📥 Commits

Reviewing files that changed from the base of the PR and between f64e1e8 and 52525e5.

📒 Files selected for processing (1)
  • administration/configuring-fluent-bit/multiline-parsing.md (4 hunks)

Walkthrough

Updated multiline parsing documentation: added Ruby parser and examples for all six built-in parsers; introduced new parser options (flush_timeout, key_content, match_string, negate), expanded type values, clarified rule usage, and revised memory-buffer unit notation and defaults.

Changes

Cohort / File(s) Summary
Multiline parsing doc
administration/configuring-fluent-bit/multiline-parsing.md
Added ruby to built-in parsers list and reordered entries; introduced new configurable properties (flush_timeout, key_content, match_string, negate); clarified type options (regex, endswith, equal/eq) and that rule applies to regex; reworked multiline_buffer_limit description to accept KB/MB/GB and binary units (KiB/MiB/GiB) with default 2MB; added comprehensive built-in parser examples (Cri, Docker, Go, Java, Python, Ruby) and adjusted formatting/content throughout.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

  • Focus areas:
    • Verify parser examples (Ruby, Python, Java, Go, Docker, Cri) match runtime behavior
    • Confirm new option semantics (negate, match_string, key_content, flush_timeout) are accurately described
    • Check unit notation and default for multiline_buffer_limit across examples and snippets
    • Ensure YAML and classic config examples are syntactically consistent

Poem

🐰
I hopped through lines of log and lore,
Found Ruby waiting by the door,
Now six parsers hum, examples bright,
I stitched their tales by morning light,
Joyful hops — the docs take flight! 🥕

Pre-merge checks and finishing touches

✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately describes the main changes: updating multiline parsing documentation with missing features (ruby parser) and adding examples.
Linked Issues check ✅ Passed Changes comprehensively address linked issue #2276: added ruby parser to built-in parsers list, documented missing configuration properties, and provided examples for all six parsers (cri, docker, go, java, python, ruby).
Out of Scope Changes check ✅ Passed All changes are directly scoped to the multiline parsing documentation requirements; configuration updates, new sections, and examples all support the stated objectives from issue #2276.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

…ing issue.

Signed-off-by: Eric D. Schabell <eric@schabell.org>
Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 0

🧹 Nitpick comments (1)
administration/configuring-fluent-bit/multiline-parsing.md (1)

23-27: Fix compound words and hyphenation per style guidelines.

Line 23 contains compound words that should be separated or hyphenated: "stacktraces" → "stack traces", "loglines" → "log lines". Additionally, lines 24, 26, and 27 use unhyphenated compound adjectives that should be hyphenated: "Go-based", "Python-based", "Ruby-based".

Apply this diff to fix these issues:

-| `docker` | Process a log entry generated by a Docker container engine. This parser supports the concatenation of large log entries split by Docker. If you use this parser, and you also want to concatenate loglines like stacktraces, you can add the [multiline filter](../../pipeline/filters/multiline-stacktrace.md) to specify additional parsers. |
+| `docker` | Process a log entry generated by a Docker container engine. This parser supports the concatenation of large log entries split by Docker. If you use this parser, and you also want to concatenate log lines like stack traces, you can add the [multiline filter](../../pipeline/filters/multiline-stacktrace.md) to specify additional parsers. |
-| `go`     | Process log entries generated by a Go based language application and perform concatenation if multiline messages are detected.          |
-| `java`   | Process log entries generated by a Google Cloud Java language application and perform concatenation if multiline messages are detected. |
-| `python` | Process log entries generated by a Python based language application and perform concatenation if multiline messages are detected.      |
-| `ruby`   | Process log entries generated by a Ruby based language application and perform concatenation if multiline messages are detected.        |
+| `go`     | Process log entries generated by a Go-based language application and perform concatenation if multiline messages are detected.          |
+| `java`   | Process log entries generated by a Google Cloud Java language application and perform concatenation if multiline messages are detected. |
+| `python` | Process log entries generated by a Python-based language application and perform concatenation if multiline messages are detected.      |
+| `ruby`   | Process log entries generated by a Ruby-based language application and perform concatenation if multiline messages are detected.        |
📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 17989cc and 74b5b6a.

📒 Files selected for processing (1)
  • administration/configuring-fluent-bit/multiline-parsing.md (4 hunks)
🧰 Additional context used
🪛 GitHub Actions: Lint PRs
administration/configuring-fluent-bit/multiline-parsing.md

[warning] 23-23: [FluentBit.Spelling] Spelling check: 'loglines'?


[warning] 23-23: [FluentBit.Spelling] Spelling check: 'stacktraces'?


[warning] 454-454: [FluentBit.Spelling] Spelling check: 'cri'?


[warning] 454-454: [FluentBit.Headings] 'cri' should use sentence-style capitalization.


[warning] 518-518: [FluentBit.Headings] 'docker' should use sentence-style capitalization.


[warning] 582-582: [FluentBit.Headings] 'go' should use sentence-style capitalization.


[warning] 584-584: [FluentBit.Spelling] Spelling check: 'goroutine'?


[warning] 647-647: [FluentBit.Headings] 'java' should use sentence-style capitalization.


[warning] 649-649: [FluentBit.Spelling] Spelling check: 'Throwable'?

🪛 GitHub Check: runner / vale
administration/configuring-fluent-bit/multiline-parsing.md

[warning] 23-23:
[vale] reported by reviewdog 🐶
[FluentBit.Spelling] Spelling check: 'stacktraces'?

Raw Output:
{"message": "[FluentBit.Spelling] Spelling check: 'stacktraces'?", "location": {"path": "administration/configuring-fluent-bit/multiline-parsing.md", "range": {"start": {"line": 23, "column": 222}}}, "severity": "INFO"}


[warning] 23-23:
[vale] reported by reviewdog 🐶
[FluentBit.Spelling] Spelling check: 'loglines'?

Raw Output:
{"message": "[FluentBit.Spelling] Spelling check: 'loglines'?", "location": {"path": "administration/configuring-fluent-bit/multiline-parsing.md", "range": {"start": {"line": 23, "column": 208}}}, "severity": "INFO"}


[warning] 713-713:
[vale] reported by reviewdog 🐶
[FluentBit.Headings] 'python' should use sentence-style capitalization.

Raw Output:
{"message": "[FluentBit.Headings] 'python' should use sentence-style capitalization.", "location": {"path": "administration/configuring-fluent-bit/multiline-parsing.md", "range": {"start": {"line": 713, "column": 5}}}, "severity": "INFO"}


[warning] 649-649:
[vale] reported by reviewdog 🐶
[FluentBit.Spelling] Spelling check: 'Throwable'?

Raw Output:
{"message": "[FluentBit.Spelling] Spelling check: 'Throwable'?", "location": {"path": "administration/configuring-fluent-bit/multiline-parsing.md", "range": {"start": {"line": 649, "column": 89}}}, "severity": "INFO"}


[warning] 647-647:
[vale] reported by reviewdog 🐶
[FluentBit.Headings] 'java' should use sentence-style capitalization.

Raw Output:
{"message": "[FluentBit.Headings] 'java' should use sentence-style capitalization.", "location": {"path": "administration/configuring-fluent-bit/multiline-parsing.md", "range": {"start": {"line": 647, "column": 5}}}, "severity": "INFO"}


[warning] 584-584:
[vale] reported by reviewdog 🐶
[FluentBit.Spelling] Spelling check: 'goroutine'?

Raw Output:
{"message": "[FluentBit.Spelling] Spelling check: 'goroutine'?", "location": {"path": "administration/configuring-fluent-bit/multiline-parsing.md", "range": {"start": {"line": 584, "column": 99}}}, "severity": "INFO"}


[warning] 582-582:
[vale] reported by reviewdog 🐶
[FluentBit.Headings] 'go' should use sentence-style capitalization.

Raw Output:
{"message": "[FluentBit.Headings] 'go' should use sentence-style capitalization.", "location": {"path": "administration/configuring-fluent-bit/multiline-parsing.md", "range": {"start": {"line": 582, "column": 5}}}, "severity": "INFO"}


[warning] 518-518:
[vale] reported by reviewdog 🐶
[FluentBit.Headings] 'docker' should use sentence-style capitalization.

Raw Output:
{"message": "[FluentBit.Headings] 'docker' should use sentence-style capitalization.", "location": {"path": "administration/configuring-fluent-bit/multiline-parsing.md", "range": {"start": {"line": 518, "column": 5}}}, "severity": "INFO"}


[warning] 454-454:
[vale] reported by reviewdog 🐶
[FluentBit.Headings] 'cri' should use sentence-style capitalization.

Raw Output:
{"message": "[FluentBit.Headings] 'cri' should use sentence-style capitalization.", "location": {"path": "administration/configuring-fluent-bit/multiline-parsing.md", "range": {"start": {"line": 454, "column": 5}}}, "severity": "INFO"}


[warning] 454-454:
[vale] reported by reviewdog 🐶
[FluentBit.Spelling] Spelling check: 'cri'?

Raw Output:
{"message": "[FluentBit.Spelling] Spelling check: 'cri'?", "location": {"path": "administration/configuring-fluent-bit/multiline-parsing.md", "range": {"start": {"line": 454, "column": 5}}}, "severity": "INFO"}

🪛 LanguageTool
administration/configuring-fluent-bit/multiline-parsing.md

[grammar] ~24-~24: Use a hyphen to join words.
Context: ... | Process log entries generated by a Go based language application and perform c...

(QB_NEW_EN_HYPHEN)


[grammar] ~26-~26: Use a hyphen to join words.
Context: ...rocess log entries generated by a Python based language application and perform c...

(QB_NEW_EN_HYPHEN)


[grammar] ~27-~27: Use a hyphen to join words.
Context: ... Process log entries generated by a Ruby based language application and perform c...

(QB_NEW_EN_HYPHEN)

🔇 Additional comments (4)
administration/configuring-fluent-bit/multiline-parsing.md (4)

37-46: Configuration properties table documentation looks comprehensive.

The expanded configuration options table properly documents the new and updated properties (flush_timeout default corrected to 4s, key_content, match_string, negate) and clarifies the conditional usage (rule only for regex type, match_string only for endswith/equal types). This aligns well with the PR objectives to document missing features and fix defaults.


265-276: Memory buffering section updates are clear and well-documented.

The clarification that KB/MB/GB and KiB/MiB/GiB suffixes are all interpreted as binary units is helpful, and the default value correction (2MB) is properly reflected in both the description and example.


450-839: Built-in parser examples section is comprehensive and well-structured.

The new section successfully addresses the PR objective to "provide comprehensive examples for all six built-in parsers." Each subsection includes consistent structure: description, YAML configuration, classic configuration, input log sample, and expected output. This greatly improves documentation usability for implementing each parser.


454-454: Heading capitalization: Apply sentence-case capitalization per project style guide.

The subheadings for parser names (cri, docker, go, java, python, ruby) are flagged by the linting pipeline as requiring sentence-case capitalization. While these are proper nouns/product names, verify against your project's Markdown style guide and apply the appropriate capitalization (e.g., ### CRI, ### Docker, ### Go, etc., or update the vale rule if lowercase is intentional for this context).

Also applies to: 518-518, 582-582, 647-647, 713-713, 778-778

… linting issue.

Signed-off-by: Eric D. Schabell <eric@schabell.org>
Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 0

🧹 Nitpick comments (2)
administration/configuring-fluent-bit/multiline-parsing.md (2)

24-24: Apply hyphenation to compound adjectives.

These lines use compound adjectives that should be hyphenated for proper grammar:

  • Line 24: "Go based language" → "Go-based language"
  • Line 26: "Python based language" → "Python-based language"
  • Line 27: "Ruby based language" → "Ruby-based language"

Apply this diff to fix the hyphenation:

-| `go`     | Process log entries generated by a Go based language application and perform concatenation if multiline messages are detected.          |
-| `python` | Process log entries generated by a Python based language application and perform concatenation if multiline messages are detected.      |
-| `ruby`   | Process log entries generated by a Ruby based language application and perform concatenation if multiline messages are detected.        |
+| `go`     | Process log entries generated by a Go-based language application and perform concatenation if multiline messages are detected.          |
+| `python` | Process log entries generated by a Python-based language application and perform concatenation if multiline messages are detected.      |
+| `ruby`   | Process log entries generated by a Ruby-based language application and perform concatenation if multiline messages are detected.        |

Also applies to: 26-26, 27-27


454-454: Use standard acronym capitalization for section header.

The section header uses "Cri" in title case, but "CRI" is the standard acronym for Container Runtime Interface. For consistency with documentation conventions, capitalize it as:

-### Cri
+### CRI
📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 74b5b6a and f64e1e8.

📒 Files selected for processing (1)
  • administration/configuring-fluent-bit/multiline-parsing.md (4 hunks)
🧰 Additional context used
🪛 GitHub Check: runner / vale
administration/configuring-fluent-bit/multiline-parsing.md

[warning] 23-23:
[vale] reported by reviewdog 🐶
[FluentBit.Spelling] Spelling check: 'stacktraces'?

Raw Output:
{"message": "[FluentBit.Spelling] Spelling check: 'stacktraces'?", "location": {"path": "administration/configuring-fluent-bit/multiline-parsing.md", "range": {"start": {"line": 23, "column": 222}}}, "severity": "INFO"}


[warning] 23-23:
[vale] reported by reviewdog 🐶
[FluentBit.Spelling] Spelling check: 'loglines'?

Raw Output:
{"message": "[FluentBit.Spelling] Spelling check: 'loglines'?", "location": {"path": "administration/configuring-fluent-bit/multiline-parsing.md", "range": {"start": {"line": 23, "column": 208}}}, "severity": "INFO"}


[warning] 715-715:
[vale] reported by reviewdog 🐶
[FluentBit.Spelling] Spelling check: 'tracebacks'?

Raw Output:
{"message": "[FluentBit.Spelling] Spelling check: 'tracebacks'?", "location": {"path": "administration/configuring-fluent-bit/multiline-parsing.md", "range": {"start": {"line": 715, "column": 36}}}, "severity": "INFO"}


[warning] 584-584:
[vale] reported by reviewdog 🐶
[FluentBit.Spelling] Spelling check: 'goroutine'?

Raw Output:
{"message": "[FluentBit.Spelling] Spelling check: 'goroutine'?", "location": {"path": "administration/configuring-fluent-bit/multiline-parsing.md", "range": {"start": {"line": 584, "column": 99}}}, "severity": "INFO"}


[warning] 454-454:
[vale] reported by reviewdog 🐶
[FluentBit.Spelling] Spelling check: 'Cri'?

Raw Output:
{"message": "[FluentBit.Spelling] Spelling check: 'Cri'?", "location": {"path": "administration/configuring-fluent-bit/multiline-parsing.md", "range": {"start": {"line": 454, "column": 5}}}, "severity": "INFO"}

🪛 LanguageTool
administration/configuring-fluent-bit/multiline-parsing.md

[grammar] ~24-~24: Use a hyphen to join words.
Context: ... | Process log entries generated by a Go based language application and perform c...

(QB_NEW_EN_HYPHEN)


[grammar] ~26-~26: Use a hyphen to join words.
Context: ...rocess log entries generated by a Python based language application and perform c...

(QB_NEW_EN_HYPHEN)


[grammar] ~27-~27: Use a hyphen to join words.
Context: ... Process log entries generated by a Ruby based language application and perform c...

(QB_NEW_EN_HYPHEN)

🔇 Additional comments (3)
administration/configuring-fluent-bit/multiline-parsing.md (3)

450-839: Comprehensive built-in parser examples section looks well-structured.

The new "Built-in parser examples" section is thorough and well-organized with:

  • All six parsers documented (cri, docker, go, java, python, ruby)
  • Consistent format for each: YAML config, classic config, sample input, and expected output
  • Realistic examples that demonstrate the multiline concatenation behavior for each parser type
  • Clear descriptions of how each parser determines line boundaries

The examples accurately reflect the parser behaviors and provide good practical guidance for users.


37-46: Configuration properties table updates are well-documented.

The expanded properties table correctly captures the new multiline parser options:

  • flush_timeout, key_content, match_string, negate are properly described
  • Updated type values (regex, endswith, equal/eq) are clearly listed
  • Constraints (e.g., "Only used with regex type" for rule) are appropriately documented

265-276: Buffer limit documentation updates provide clarity on unit notation.

The updated multiline_buffer_limit section correctly:

  • Specifies binary unit interpretation for both KB/MB/GB and KiB/MiB/GiB suffixes
  • Updates the default value to 2MB (matching source code)
  • Adds practical context about memory usage in containerized environments (Kubernetes)

…review comment.

Signed-off-by: Eric D. Schabell <eric@schabell.org>
@eschabell
Copy link
Collaborator Author

AI review passed, merging this fix @alexakreizinger.

@eschabell eschabell merged commit 91c369d into fluent:master Dec 4, 2025
8 checks passed
@eschabell eschabell deleted the erics_multiline_parsers_doc_update branch December 4, 2025 13:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Multiline parsers page missing Ruby in list of available parsers and needs examples

1 participant