Multiline Config not applied

[LarsWinters]

Hi all,

we try to set a MultiLineConfig for all Namespaces, Pods and Containers. It should use Multiline for all logs starting with "Caused by" or a leading whitespace. The config looks like this:

multilineConfigs:
      - namespaceName:
          value: .*
        podName:
          value: .*
          useRegexp: true
        containerName:
          value: .*
        firstEntryRegex: ^(?:\s|Caused by)

If I put this regex in regex101 and test it with a Log it works just fine. I suppose it doesn't apply correctly. Is the wildcard .* valid?
Or any other ideas why it doesn't work?
Best regards

[atoulme]

You might need to set useRegexp on the other fields:

multilineConfigs:
      - namespaceName:
          value: .*
          useRegexp: true
        podName:
          value: .*
          useRegexp: true
        containerName:
          value: .*
          useRegexp: true
        firstEntryRegex: ^(?:\s|Caused by)

[wedge22]

Do you see a specific error when trying to deploy? My only other suggestion would be adding ""

multilineConfigs: - namespaceName: value: ".*" useRegexp: true podName: value: ".*" useRegexp: true containerName: value: ".*" useRegexp: true firstEntryRegex: ^(?:\s|Caused by)

[matthewmodestino]

Antoine has likely identified your issue. It is also handy to review what this renders in the configmap so you can read the logic.

I have to advise this is really not recommended, as its is very unlikely your entire cluster needs the logs passed thru this regex. Will likely result in unexpected issues and performance impacts.

It is strongly recommended to try and target the actual workloads that this rule will apply. You can create some pretty flexible rules if you look under the hood in the configmap and take the router and operator logic and move it into extraOperators section.

Otherwise 🤷 yolo!

[LarsWinters]

Yes! The the solution was to enable useRegexp for all "layers". Thanks @atoulme

Also thank you @matthewmodestino for the advices. We will look into it and try to specify it to the very specific workloads!