Log Monitoring v2 - Multi Line Log Entries

[mathias_indermu]

I just switched an environment to log monitoring v2 and I was looking forward to doing it for a long time. Even though log-monitoring might not be the stronghold of an APM, it still is an enormously important part of application operation. Glad Dynatrace did some baby steps there 🙂

Anyway, my question regarding logv2, I have log entries that span across multiple lines. This was handled without any issue in version 1. Version 2 creates an entry for each line - which makes reading and analyzing logs impossible.

Any idea how to solve this? 

[Julius_Loman]

For example - custom log shippers such as fluentd or filebeat+logstash with the dynatrace output together with generic log ingestion will solve it, but it requires additional tools.

Or maybe you can reconfigure your app to log in the JSON format? Unstructured multiline logs are always a pain, regardless of the tooling.

[Christophe_N]

Hi,

I have the same issue, and unfortunetaly, got no solution for you for the moment.
As additional information, I observed this only for some type of app logs, the trigger may be the source process..
I will take any suggestion to help also 🙂

Christophe

[mathias_indermu]

The system I'm observing the logs is sitecore, and the logger is log4net.
logging - Can not use log4net.Ext.Json to make Json log in Sitecore related project - Stack Overflow
I'm not keen to dive into this configuration to be honest.  @Julius_Loman your recommendation is to implement further tools. But actually, Dynatrace Log v1 was able to read the logs correct - why not make the effort to improve log v2 this way?

[Julius_Loman · Accepted solution]

@mathias_indermu  sure, you are right, one should not have to put other tools. But that's a question for the PM if such functionality is on the roadmap.   Maybe @michal_dec can answer that.

There is missing functionality when it gets to the log parsing when using OneAgent as the log shippers. I'm missing mostly filtering capabilities (e.g. not ship DEBUG level log entries for example).

[mathias_indermu]

Thanks @Julius_Loman , I missed your Job description and thought you might represent Dynatrace. I will add a Ticket for the idea to improve it. Let's see. 

This would be nice, also a standalone agent, which is easy to configure for log-ingestion (like a Splunk agent) would be nice together with the new api capabilities. But log-details can often be configured from the application.

[mathias_indermu]

Enable Log v2 to handle multiline log-entries - Dynatrace Community