<p>I am using
Docker version 17.12.1-ce
Kubernetes verision v1.10.11</p>

<p>My application prints the log in Json format to the console. One of the fields is stackTrace, which can include a huge stackTrace. </p>

<p>The problem is that the log message is split up into two messages. So if I look at the  /var/lib/docker/containers/ ... .log I see two messages. I read that this is done for security reasons, but I don't really understand what I can do with that? </p>

<p>Should I cut my stackTrace? Or customize the size? Is this permitted? Is it the correct way to deal with this issue? </p>

<p>p/s I am using json-file logging driver</p>

liotur
<p>This is an expected behavior.
Docker chunks log messages at 16K, because of a 16K buffer for log messages. If a message length exceeds 16K, it should be split by the json file logger and merged at the endpoint.</p>

<p>It does mark the log as a partial message but really depends on the driver/service to re-assemble.</p>

<p><a href="https://docs.docker.com/config/containers/logging/configure/" rel="nofollow noreferrer">Docker Docs</a> mentions that there are different supported drivers. </p>

<p>With your architecture (Stacktraces), the <code>json-driver</code> might be not a best option.</p>

<p>And I've found <a href="https://github.com/moby/moby/issues/32923" rel="nofollow noreferrer">this thread on github</a> that adds additional info on topic (as well as a lot of offtop).</p>

<p>Edit. </p>

<p><a href="https://kubernetes.io/docs/concepts/cluster-administration/logging/" rel="nofollow noreferrer">Logging Architecture</a> says that everything a containerized application writes to <code>stdout</code> and <code>stderr</code> is handled and redirected somewhere by a container engine. </p>

<p>The Docker container engine redirects those two streams to a logging driver, which is configured in Kubernetes to write to a file in json format.</p>

<p>Note: The Docker json logging driver treats <em>each line</em> as a separate message. 
Another peculiarity is that when using the Docker logging driver, there is no direct support for multi-line messages. You need to handle multi-line messages at the logging agent level or higher.</p>

<blockquote>
  <p>I don't really understand what I can do with that?</p>
</blockquote>

<p>It's a limitation on Docker size. <a href="https://github.com/moby/moby/issues/34855" rel="nofollow noreferrer">Here</a> is another good discussion that ends up with the idea to use filebeat/fluentd .</p>

<p>It looks like the <a href="https://docs.fluentbit.io/manual/v/1.3/input/tail#docker_mode" rel="nofollow noreferrer">Docker_mode</a> option for Fluentbit might help, but I'm not sure how exactly you are parsing container logs. </p>

<blockquote>
  <p>Should I cut my stackTrace? </p>
</blockquote>

<p>It depends if you need traces in logs or not. </p>

<blockquote>
  <p>Or customize the size?
  I have searched for some kind of "knob" to adjust on Docker side, and can't find any as of now.</p>
</blockquote>

<p>It looks like the only solution for that is to use some log processing tool that can combine split lines.</p>
