Parsing logs from Python Docker container sent to Splunk HEC

reallyliri — Thu, 18 Oct 2018 15:54:41 GMT

I'm sending all my docker containers logs to my local Splunk server.

One of these containers is running a Python server (using Flask/nginx).

For debugging and log file reasons, my Python logs are foramtted with a standard line: %(asctime)s - %(name)s - %(levelname)s - %(message)s

I can see the log line clearly in Splunk, however, I would also want to parse the timestamp, log-level etc. In addition, it seems that stack traces are split to multiple messages.

Note that not all messages from the host sent to this server are from Python, but the other ones don't require additional formatting.

So:

How can I configure Splunk to parse my messages according to my log format?
How can I merge the stack trace logs to a single message (I'm guessing that it should be done on consuming)
Can I define formatting for the Python messages without damaging the 'other' messages?

topic Parsing logs from Python Docker container sent to Splunk HEC in Splunk Dev

Parsing logs from Python Docker container sent to Splunk HEC