Hi

What's the recommended way to format this?

2023-11-26T01:37:22.070084925-06:00 container destroy c68d069d7aeb401013d2f85f5cba03ce49048557747842e1d2d95553ab12043c (com.docker.stack.namespace=dcp-notifications, com.docker.swarm.node.id=gb1cto7gaq68fp4refnsr5hep, com.docker.swarm.service.id=sgzwrwxqv1j9cwas8rjw57qwh, com.docker.swarm.service.name=dcp-notifications_gotify, com.docker.swarm.task=, com.docker.swarm.task.id=0h30og9viwjcu0fgr9uadw44p, com.docker.swarm.task.name=dcp-notifications_gotify.1.0h30og9viwjcu0fgr9uadw44p, image=gotify/server:latest@sha256:436a75a37795fed03df4d183c007b9d7d84329d4e92067121ff77f08e78cdadf, name=dcp-notifications_gotify.1.0h30og9viwjcu0fgr9uadw44p)
2023-11-26T01:37:24.694138377-06:00 container exec_create: /bin/sh -c /usr/local/bin/healthcheck 24ddf71ea3163f85cd6c7f54137b658b18a386326fe70e8b22a22148fe4631a7 (com.docker.stack.namespace=dcp-downloaders, com.docker.swarm.node.id=gb1cto7gaq68fp4refnsr5hep, com.docker.swarm.service.id=pw8jqafdiv2ypo1d0xdr9jxnx, com.docker.swarm.service.name=dcp-downloaders_rutorrent, com.docker.swarm.task=, com.docker.swarm.task.id=je15qmqrfkdyg4lvdjzeocb3k, com.docker.swarm.task.name=dcp-downloaders_rutorrent.1.je15qmqrfkdyg4lvdjzeocb3k, execID=b7a7104ebd64f038eca8b50b65868357867d51263caa38b45029f8d6f52e59eb, image=ghcr.io/crazy-max/rtorrent-rutorrent:latest@sha256:4e0df24d4f168d705c9864dad04e99c1c55c9e987e7bf0b6b0c84efb686ef858, name=dcp-downloaders_rutorrent.1.je15qmqrfkdyg4lvdjzeocb3k, org.opencontainers.image.created=2023-11-18T18:12:25.503Z, org.opencontainers.image.description=rTorrent and ruTorrent, org.opencontainers.image.licenses=MIT, org.opencontainers.image.revision=56abffe6f59c52880359afe3589c101833fb2abb, org.opencontainers.image.source=https://github.com/crazy-max/docker-rtorrent-rutorrent, org.opencontainers.image.title=rTorrent and ruTorrent, org.opencontainers.image.url=https://github.com/crazy-max/docker-rtorrent-rutorrent, org.opencontainers.image.vendor=CrazyMax, org.opencontainers.image.version=4.2.9-0.9.8-0.13.8)
2023-11-26T01:37:24.694365487-06:00 container exec_start: /bin/sh -c /usr/local/bin/healthcheck 24ddf71ea3163f85cd6c7f54137b658b18a386326fe70e8b22a22148fe4631a7 (com.docker.stack.namespace=dcp-downloaders, com.docker.swarm.node.id=gb1cto7gaq68fp4refnsr5hep, com.docker.swarm.service.id=pw8jqafdiv2ypo1d0xdr9jxnx, com.docker.swarm.service.name=dcp-downloaders_rutorrent, com.docker.swarm.task=, com.docker.swarm.task.id=je15qmqrfkdyg4lvdjzeocb3k, com.docker.swarm.task.name=dcp-downloaders_rutorrent.1.je15qmqrfkdyg4lvdjzeocb3k, execID=b7a7104ebd64f038eca8b50b65868357867d51263caa38b45029f8d6f52e59eb, image=ghcr.io/crazy-max/rtorrent-rutorrent:latest@sha256:4e0df24d4f168d705c9864dad04e99c1c55c9e987e7bf0b6b0c84efb686ef858, name=dcp-downloaders_rutorrent.1.je15qmqrfkdyg4lvdjzeocb3k, org.opencontainers.image.created=2023-11-18T18:12:25.503Z, org.opencontainers.image.description=rTorrent and ruTorrent, org.opencontainers.image.licenses=MIT, org.opencontainers.image.revision=56abffe6f59c52880359afe3589c101833fb2abb, org.opencontainers.image.source=https://github.com/crazy-max/docker-rtorrent-rutorrent, org.opencontainers.image.title=rTorrent and ruTorrent, org.opencontainers.image.url=https://github.com/crazy-max/docker-rtorrent-rutorrent, org.opencontainers.image.vendor=CrazyMax, org.opencontainers.image.version=4.2.9-0.9.8-0.13.8)

For parsing the message, I am not 100% clear on what you are after, but you can extract more detail from the message.  For example, consider the pattern:

%d{yyyy-MM-ddT%H:mm:ss.fffffffffzzzz} %c %s{Action} %S{Command} (%S, com.docker.swarm.node.id=%S{NodeId}, %S{Key1}=%S{Value1}, %m)%n

This would parse your logs into:


So it really just depends on the information you are interested in.  Note that when parsing the log file, all log entries must have the same format.  If the log entry format, or the information you are after has a lot of variation you might be better off using a Message Filter instead.  Sometimes a two-stage parse is best.

Window sizes and additional help are both great ideas - thanks for the suggestion!  I will take a look and see what we can do before the next release.

Hope that helps,

Toby