<p>How can I aggregate the log events to a single entry even though it is logged in multiple lines through application logger when docker is deployed to gcp kubernetes cluster.</p>

<p>For AWS we can use the date time format to identify the start of an event. What is the substitute in GCP.</p>

<p>Thanks.</p>

Vineeth Kiv
<p>In my opinion, you need a dedicated solution to manage your logs really effectively.</p>

<p>One of the most popular solutions for aggregating/managing/sharing logs is <a href="https://www.elastic.co/products" rel="nofollow noreferrer">ELK stack</a>, i.e. <code>ElasticSearch, Logstash, Kibana</code> or another version of similar stack, but with <code>Fluentd</code> instead of <code>Logstash</code>: <code>EFK stack</code>.</p>

<p>ELK Stack has a list of streamers or "<a href="https://www.elastic.co/products/beats" rel="nofollow noreferrer">data shippers</a>", which names are <code>beats</code>. One of them is <code>Filebeat</code>, which unsurprisingly works with files. In the nutshell it can read a file via <code>tail</code> method. So you can read any file. </p>

<p>The <code>Filebeat</code> <a href="https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html" rel="nofollow noreferrer">supports configuration options</a> to resolve your issue. They are:</p>

<pre><code>multiline.pattern:
multiline.negate: 
multiline.match:
</code></pre>

<p>Generally, you should define regular expression which is describing the beginning of your lines unequivocally.</p>

<p>So, try this out. This stack supports different types of integration with the Kubernetes, e.g. in-cluster deployment and <a href="https://www.elastic.co/guide/en/beats/filebeat/current/configuration-autodiscover.html" rel="nofollow noreferrer">autodiscover</a></p>
