I'm using the splunk-otel-collector, and attempting to get multi-line java exceptions into a standardly formatted event. Using the example, my values file contains
multilineConfigs:
- namespaceName:
value: example
useRegexp: true
firstEntryRegex: ^[^\s].*
combineWith: ""
The rendered configMap contains
- combine_field: attributes.log
combine_with: ""
id: example
is_first_entry: (attributes.log) matches "^[^\\s].*"
max_log_size: 1048576
output: clean-up-log-record
source_identifier: resource["com.splunk.source"]
type: recombine
With that config, the logs continue to split . Then I change the value to
combineWith: "\t"
the following happens with the logs:
Has anyone experienced this and worked around it?
If you use
combineWith: "\t"
the log entries are correctly splitted or not?
Could you remove the combinedWith parameter from the config and deploy it again?