<p>I want to apply concat filter to the logs of a java app that is deployed on Kubernetes to concatenate multiline logs (not only exceptions) into one log event..</p>
<p>This is the final working version after fixing the problems.</p>
<p>The idea is to add a label to the deployment</p>
<pre><code>metadata:
  ...
spec:
  ...
  template:
    metadata:
      labels:
        logtype: springboot
</code></pre>
<p>Fluentd config:</p>
<pre><code># rewrite tag of events with kubernetes label kubernetes.labels.logtype=springboot
#
# it is important to change the tag. If the tag is not modified the event will be
# reemitted with the same tag and matched again by the rewrite tag filter -&gt; infinite loop
&lt;match kubernetes.var.log.containers.**&gt;
  @type rewrite_tag_filter
  @log_level debug
  &lt;rule&gt;
    key $.kubernetes.labels.logtype
    pattern /^springboot$/
    tag springboot.${tag}
  &lt;/rule&gt;
  # the rewrite tag filter is an event sink. Events that are not reemitted by the plugin
  # are gone. So we need a catch-all rule to reemitt any event that is not caught
  # by the spring boot rule.
  &lt;rule&gt;
    key log
    pattern /^.*$/
    # and the tag must be changed so that the event will skip the rewrite filter after reemitting
    tag unmatched.${tag}
  &lt;/rule&gt;
&lt;/match&gt;

# Handle multiline logs for springboot logs.
&lt;filter springboot.**&gt;
  @type concat
  key log
  separator &quot;&quot;
  multiline_start_regexp /^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3}\  (ERROR|WARN|INFO|DEBUG|TRACE)/
&lt;/filter&gt;
</code></pre>

Nils Rommelfanger
<ol>
<li><code>&lt;match **/&gt;</code> - this either has a typo or it's an invalid fluentd config</li>
<li>I need to see the full config to be sure, but <code>&lt;match **&gt;</code> will match the rewritten tag as well, before it gets to <code>&lt;match springboot.**&gt;</code>. To avoid this, put match spring boot before the <code>**</code> match, or shrink the <code>**</code> match to what is coming from the kube, e.g. <code>&lt;match kube.**&gt;</code>. Re-tagged events are injected back to the begging of the pipeline, and go thru its parts in the order they appear in a config.</li>
</ol>
