could not load multiline parsers #10165
Description
Similar to #9507
I am seeing errors around multi line parsers
I see this error if I do the following
multiline.parser multiline-regex-test
Fluent Bit v3.2.7
* Copyright (C) 2015-2025 The Fluent Bit Authors
* Fluent Bit is a CNCF sub-project under the umbrella of Fluentd
* https://fluentbit.io
______ _ _ ______ _ _ _____ _____
| ___| | | | | ___ (_) | |____ |/ __ \
| |_ | |_ _ ___ _ __ | |_ | |_/ /_| |_ __ __ / /`' / /'
| _| | | | | |/ _ \ '_ \| __| | ___ \ | __| \ \ / / \ \ / /
| | | | |_| | __/ | | | |_ | |_/ / | |_ \ V /.___/ /./ /___
\_| |_|\__,_|\___|_| |_|\__| \____/|_|\__| \_/ \____(_)_____/
[2025/04/02 14:53:45] [error] [parser] parser named 'docker' already exists, skip.
[2025/04/02 14:53:45] [ info] [fluent bit] version=3.2.7, commit=ccd3586226, pid=1
[2025/04/02 14:53:45] [ info] [storage] ver=1.5.2, type=memory, sync=normal, checksum=off, max_chunks_up=128
[2025/04/02 14:53:45] [ info] [simd ] disabled
[2025/04/02 14:53:45] [ info] [cmetrics] version=0.9.9
[2025/04/02 14:53:45] [ info] [ctraces ] version=0.6.0
[2025/04/02 14:53:45] [ info] [input:tail:tail.0] initializing
[2025/04/02 14:53:45] [ info] [input:tail:tail.0] storage_strategy='memory' (memory only)
[2025/04/02 14:53:45] [error] [multiline] parser 'multiline-regex' not registered
[2025/04/02 14:53:45] [error] [input:tail:tail.0] could not load multiline parsers
[2025/04/02 14:53:45] [error] failed initialize input tail.0
[2025/04/02 14:53:45] [error] [engine] input initialization failed
What is the correct way (in v3.2) to declare a multi line parser please?
This is my a snippet of my values.yaml file which is deployed in ArgoCD via Terraform.
# Default values for Fluent Bit.
config:
service: |
[SERVICE]
Daemon Off
Flush 5
Log_Level info
Parsers_File /fluent-bit/etc/parsers.conf
Parsers_File /fluent-bit/etc/conf/custom_parsers.conf
HTTP_Server On
HTTP_Listen 0.0.0.0
HTTP_Port 2020
Health_Check On
HC_Errors_Count 5
HC_Retry_Failure_Count 5
HC_Period 5
inputs: |
[INPUT]
Name tail
Exclude_Path /var/log/containers/*fluent-bit*.log,/var/log/containers/*collector-xray-collector*.log
Path /var/log/containers/*.log
multiline.parser docker, cri, java
Tag kube.*
DB /var/log/flb_kube.db
Docker_Mode Off
Mem_Buf_Limit 50MB
Skip_Long_Lines On
Refresh_Interval 30
# Parser docker
filters: |
[FILTER]
Name kubernetes
Match kube.*
Merge_Log Off
Merge_Log_Key log_processed
Keep_Log On
K8S-Logging.Parser On
K8S-Logging.Exclude Off
Buffer_Size 32k
[FILTER]
Name modify
Match *
Add enc.stack ${stack}
Add enc.platform eks
outputs: |
[OUTPUT]
Name opensearch
Match kube.*
Host xxxxxxxxx
Port 443
tls On
AWS_Region eu-west-1
AWS_Auth Off
HTTP_User xxxxx
HTTP_Passwd xxxxx
Type _doc
Logstash_Format On
Logstash_Prefix logstash
Logstash_DateFormat %Y.%m.%d
Time_Key @timestamp
Time_Key_Format %Y-%m-%dT%H:%M:%S
Time_Key_Nanos Off
Include_Tag_Key Off
Generate_ID Off
Write_Operation create
Replace_Dots On
Trace_Output On
Trace_Error On
Current_Time_Index Off
Suppress_Type_Name On
Workers 1
Retry_Limit 1
customParsers: |
[PARSER]
Name docker
Format json
Time_Keep On
Time_Key time
Time_Format %Y-%m-%dT%H:%M:%S.%L
[MULTILINE_PARSER]
name multiline-regex-test
type regex
flush_timeout 1000
rule "start_state" "/([a-zA-Z]+ \d+ \d+\:\d+\:\d+)(.*)/" "cont"
rule "cont" "/^\s+at.*/" "cont"
volumeMounts:
- name: config
mountPath: /fluent-bit/etc/conf
daemonSetVolumes:
- name: varlog
hostPath:
path: /var/log
- name: varlibdockercontainers
hostPath:
path: /var/lib/docker/containers
- name: etcmachineid
hostPath:
path: /etc/machine-id
type: File
command:
- /fluent-bit/bin/fluent-bit
args:
- --workdir=/fluent-bit/etc
- --config=/fluent-bit/etc/conf/fluent-bit.conf