Logging - Trim newlines and white chars

[Karql]

Hi!

Some logs like:

add new lines and white characters to output.

This behavior makes logs parsing more difficult.

I've seen logging section in configuration but as I've searched it is not possible to strip log message using formatter.

Maybe you could change these multi-line logs?

Best regards,
Mateusz

[nsano-rururu]

If you know where to fix it, please pull request. There is no rule that you should not make a pull request.

[nsano-rururu]

Are there any other similar parts? .. Is it just the point you pointed out?

[nsano-rururu]

I don't think it's a question that takes time to answer. Are you ignoring me?

[nsano-rururu]

I don't know what happened in the past, but I think it was implemented in that way to make it stand out in debug mode.

[nsano-rururu]

In the first place, it seems that you are requesting to change it because you are in trouble when you capture the log in elasticsearch and display it, but is it different?

[nsano-rururu]

If there is a counterargument, please refute it. I feel sick

[Karql]

If you know where to fix it, please pull request. There is no rule that you should not make a pull request.

I'd like to start discussion first.
Btw. I am not a python guy so I would prefer not to make changes.

By the way, does this mean you want it fixed for elastalert2-server?

Yes

What is a formatter?

https://github.com/jertel/elastalert2/blob/master/examples/config.yaml.example#L91

https://stackoverflow.com/questions/17931426/strip-newline-and-white-spaces-from-python-logger-messages

Are there any other similar parts? .. Is it just the point you pointed out?

This is the first place I've noticed. I have not reviewed all source code.

I don't think it's a question that takes time to answer. Are you ignoring me?

I was away from the computer.

In the first place, it seems that you are requesting to change it because you are in trouble when you capture the log in elasticsearch and display it, but is it different?

When log is splited into multiple lines it is difficult to for expample caputre it by fluentd.

[nsano-rururu]

It feels strange to write another person's request on your behalf rather than what you want it to do.

[nsano-rururu]

If you want to change it, please make a pull request. The story ends.

[nsano-rururu]

Check it out. You don't know much about fluentd

Fluentdで複数行のログを読む
https://kazuhira-r.hatenablog.com/entry/2021/01/28/000628
Fluentdのin_tailプラグインで複数行のログをよむ方法
https://kazegusuri.hateblo.jp/entry/2014/06/28/201239
複数行のログをキーワード監視＆通知することで運用を少し改善しよう
https://qiita.com/uzresk/items/935baa47f83921158276
Multi format parser plugin for Fluentd
https://github.com/repeatedly/fluent-plugin-multi-format-parser
multiline
https://docs.fluentd.org/parser/multiline

[nsano-rururu]

Please see the project guidelines properly.
#11

[nsano-rururu]

Ask questions about fluentd in the fluentd community.
https://github.com/fluent/fluentd

[Karql]

fluentd is just an example.

It always a good practice to keep logs in single lines or add possibility to configure it in that way e.g. structured logging

So this is not:

fixing for elastalert2-server.

but idea how to improve this project...

Please see the project guidelines properly.

IMO you should do it first.

[nsano-rururu]

@Karql

If you want to change it, do it yourself.

[nsano-rururu]

elastalert2-server is not an official tool. You are the one who thinks about it.

fixing for elastalert2-server.

but idea how to improve this project...

[nsano-rururu]

Do you understand OSS? In the first place, there is no obligation to fix bugs or respond to requests. I was very disappointed.

[nsano-rururu]

The johnsusek/elastalert-server and johnsusek/praeco I maintain are also recognized as unofficial tools.

[nsano-rururu]

It is my policy to be strict with people and strict with myself.