创建部署问题时，请参考下面模板，你提供的信息越多，越容易及时获得解答。如果未按模板创建问题，管理员有权关闭问题。
确保帖子格式清晰易读，用 markdown code block 语法格式化代码块。
你只花一分钟创建的问题，不能指望别人花上半个小时给你解答。
操作系统信息
例如：虚拟机 ， Ubuntu18.04，4C/16G
Kubernetes版本信息
将 kubectl version 命令执行结果贴在下方
Client Version: version.Info{Major:“1”, Minor:“21”, GitVersion:“v1.21.3”, GitCommit:“ca643a4d1f7bfe34773c74f79527be4afd95bf39”, GitTreeState:“clean”, BuildDate:“2021-07-15T21:04:39Z”, GoVersion:“go1.16.6”, Compiler:“gc”, Platform:“windows/amd64”}
Server Version: version.Info{Major:“1”, Minor:“22”, GitVersion:“v1.22.10”, GitCommit:“eae22ba6238096f5dec1ceb62766e97783f0ba2f”, GitTreeState:“clean”, BuildDate:“2022-05-24T12:50:52Z”, GoVersion:“go1.16.15”, Compiler:“gc”, Platform:“linux/amd64”}
容器运行时
将 docker version / crictl version / nerdctl version 结果贴在下方
KubeSphere版本信息
例如：v2.1.1/v3.0.0。离线安装还是在线安装。在已有K8s上安装。
问题是什么
FluentBit 配置多行日志失败。
fluent-bit.conf:
$$
[Service]
Parsers_File parsers.conf
[Input]
Name tail
Path /var/bim/log/.log
Refresh_Interval 10
Skip_Long_Lines true
DB /fluent-bit/tail/pos.db
DB.Sync Normal
Mem_Buf_Limit 5MB
Tag app.
Multiline true
Parser_Firstline multiline
[Filter]
Name kubernetes
Match kube.*
Kube_URL https://kubernetes.default.svc:443
Kube_CA_File /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
Kube_Token_File /var/run/secrets/kubernetes.io/serviceaccount/token
Labels false
Annotations false
[Filter]
Name nest
Match kube.*
Operation lift
Nested_under kubernetes
Add_prefix kubernetes_
[Filter]
Name modify
Match kube.*
Remove stream
Remove kubernetes_pod_id
Remove kubernetes_host
Remove kubernetes_container_hash
[Filter]
Name nest
Match kube.*
Operation nest
Wildcard kubernetes*
Nest_under kubernetes
Remove_prefix kubernetes
[Filter]
Name lua
Match app.*
script /fluent-bit/config/systemd.lua
call add_appname
time_as_table true
[Output]
Name es
Match_Regex app.*
Host elasticsearch-logging-data.kubesphere-logging-system.svc
Port 9200
Logstash_Format true
Logstash_Prefix bim-svc
Time_Key @timestamp
Generate_ID true
[Output]
Name es
Match_Regex (?:kube|service).(.*)
Host elasticsearch-logging-data.kubesphere-logging-system.svc
Port 9200
Logstash_Format true
Logstash_Prefix ks-logstash-log
Time_Key @timestamp
Generate_ID true
$$
parsers.conf:
$$
[PARSER]
Name multiline
Format regex
Regex /?<time>\d+-\d+-\d+ (?<message>.*)/m
$$
systemd.lua:
$$
function add_time(tag, timestamp, record)
new_record = record
timeStr = os.date(“!*t”, timestamp[“sec”])
t = string.format(“%4d-%02d-%02dT%02d:%02d:%02d.%sZ”,
timeStr[“year”], timeStr[“month”], timeStr[“day”],
timeStr[“hour”], timeStr[“min”], timeStr[“sec”],
timestamp[“nsec”])
kubernetes = {}
kubernetes[“pod_name”] = record[“_HOSTNAME”]
kubernetes[“container_name”] = record[“SYSLOG_IDENTIFIER”]
kubernetes[“namespace_name”] = “kube-system”
new_record[“time”] = t
new_record[“log2”] = record[“MESSAGE”]
return 1, timestamp, new_record
end
function add_appname(tag, timestamp, record)
new_record = record
log = record[“message”]
new_record[“application_name”] = string.sub(log,string.find(log, “ApplicationName” , 2)+17 ,string.find(log, “|” , 35)-2)
return 1, timestamp, new_record
end
$$
对应的日志内容为：
输出的全是单行的日志 是否配置有问题？
