Container logs

%3CLINGO-SUB%20id%3D%22lingo-sub-218828%22%20slang%3D%22en-US%22%3EContainer%20logs%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-218828%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe're%20ingesting%20AKS%20(kubernetes)%20logs%20into%20an%20OMS%20using%20the%20built%20in%20OMS%20agent.%3C%2FP%3E%3CP%3EThe%20problem%20with%20this%20is%20that%20multi-line%20loggings%20are%20handled%20as%20multiple%20LogEntries.%3C%2FP%3E%3CP%3EThis%20is%20for%20example%20the%20case%20with%20exceptions%20being%20logged%20including%20stacktrace.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EDo%20I%20look%20into%20remove%20the%20newlines%20from%20all%20log%20events%3F%3CBR%20%2F%3EThis%20will%20improve%20cleanliness%20as%20it%20will%20contain%20one%20log%20event%20per%20entry%20but%20will%20decrease%20readability.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20can%20find%20the%20first%20line%20of%20the%20log%20event.%20So%20it%20could%20be%20an%20option%20to%20get%20the%20X%20next%20log%20events%20after%20this%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAny%20advice%20is%20welcome.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-218828%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EQuery%20Language%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1117540%22%20slang%3D%22en-US%22%3ERe%3A%20Container%20logs%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1117540%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F168146%22%20target%3D%22_blank%22%3E%40Bjorn%20Vandenbilcke%3C%2FA%3E%26nbsp%3Bdid%20you%20manage%20to%20find%20a%20solution%20for%20this%20issue%3F%20I%20am%20facing%20this%20issue%20while%20starting%20up%20a%20azure%20function%20inside%20AKS%20container.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1117721%22%20slang%3D%22en-US%22%3ERe%3A%20Container%20logs%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1117721%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F525031%22%20target%3D%22_blank%22%3E%40umairsyed%3C%2FA%3E%26nbsp%3Busing%20something%20like%20Serilog%20will%20generate%20single%20line%20logs.%20Added%20benefit%20is%20that%20it's%20beter%20suited%20for%20structured%20logging.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

Hi,

 

We're ingesting AKS (kubernetes) logs into an OMS using the built in OMS agent.

The problem with this is that multi-line loggings are handled as multiple LogEntries.

This is for example the case with exceptions being logged including stacktrace.

 

Do I look into remove the newlines from all log events?
This will improve cleanliness as it will contain one log event per entry but will decrease readability.

 

I can find the first line of the log event. So it could be an option to get the X next log events after this?

 

Any advice is welcome.

 

Thanks

2 Replies
Highlighted

@Bjorn Vandenbilcke did you manage to find a solution for this issue? I am facing this issue while starting up a azure function inside AKS container.

Highlighted

@umairsyed using something like Serilog will generate single line logs. Added benefit is that it's beter suited for structured logging.