From 40d3e4257627f11a2b9d419e454bebfc8581e636 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20Collonval?=
 <fcollonval@users.noreply.github.com>
Date: Wed, 11 Sep 2024 12:08:50 +0200
Subject: [PATCH] Combine multiline log into single entry

---
 .../templates/logs-collector.yaml             | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/charts/datalayer-observer/templates/logs-collector.yaml b/charts/datalayer-observer/templates/logs-collector.yaml
index 17ae387..2b1c96d 100644
--- a/charts/datalayer-observer/templates/logs-collector.yaml
+++ b/charts/datalayer-observer/templates/logs-collector.yaml
@@ -31,6 +31,26 @@ spec:
           - type: container
             id: container-parser
             max_log_size: 102400
+          # Router to use different multiline logs logic
+          - type: router
+            routes:
+              - output: combine_python_otel_logs
+                expr: 'resource["k8s.container.name"] in ["iam", "jupyter", "operator", "operator-companion"]'
+            default: combine_logs
+          - id: combine_python_otel_logs
+            type: recombine
+            output: noop
+            combine_field: body
+            # Match asctime '<YEAR>-<MONTH>-<DAY> <HOUR>:'
+            is_first_entry: body matches "^\\d{4}-\\d{2}-\\d{2} \\d{2}:"
+            source_identifier: attributes["log.file.path"]
+          - id: combine_logs
+            type: recombine
+            combine_field: body
+            is_first_entry: body matches "^[^\\s]"
+            source_identifier: attributes["log.file.path"]
+          # Trick to skip routes
+          - type: noop
 
     processors:
       # https://github.com/open-telemetry/opentelemetry-collector/tree/main/processor/batchprocessor