From d04e7fa0f17e93d9732a01911f0955d52ca43b5e Mon Sep 17 00:00:00 2001
From: Stefan Reimer <stefan@zero-downtime.net>
Date: Tue, 8 Sep 2020 13:12:21 +0100
Subject: [PATCH] Add Lua functions to reassemble partial cri-o logs

---
 charts/kubezero-logging/values.yaml | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/charts/kubezero-logging/values.yaml b/charts/kubezero-logging/values.yaml
index 595d94d5..1cb9b32b 100644
--- a/charts/kubezero-logging/values.yaml
+++ b/charts/kubezero-logging/values.yaml
@@ -234,6 +234,12 @@ fluent-bit:
           DB.Sync Normal
 
     filters: |
+      [FILTER]
+          Name    lua
+          Match   kube.*
+          script  /fluent-bit/etc/functions.lua
+          call    reassemble_cri_logs
+
       [FILTER]
           Name kubernetes
           Match kube.*
@@ -290,6 +296,25 @@ fluent-bit:
           end
       end
 
+      local reassemble_state = {}
+
+      function reassemble_cri_logs(tag, timestamp, record)
+         -- IMPORTANT: reassemble_key must be unique for each parser stream
+         -- otherwise entries from different sources will get mixed up.
+         -- Either make sure that your parser tags satisfy this or construct
+         -- reassemble_key some other way
+         local reassemble_key = tag
+         -- if partial line, accumulate
+         if record.logtag == 'P' then
+            reassemble_state[reassemble_key] = reassemble_state[reassemble_key] or "" .. record.message
+            return -1, 0, 0
+         end
+         -- otherwise it's a full line, concatenate with accumulated partial lines if any
+         record.message = reassemble_state[reassemble_key] or "" .. record.message
+         reassemble_state[reassemble_key] = nil
+         return 1, timestamp, record
+      end
+
   serviceMonitor:
     enabled: true
     namespace: monitoring