# Fluentbit retrieve slow logs from pxc

**URL:** <https://forums.percona.com/t/fluentbit-retrieve-slow-logs-from-pxc/19458>\
**Category:** Percona XtraDB Cluster\
**Created:** [January 4, 2023, 3:19pm UTC](https://forums.percona.com/t/fluentbit-retrieve-slow-logs-from-pxc/19458 "2023-01-04T15:19:53Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![no\_way](https://avatars.discourse-cdn.com/v4/letter/n/bb73d2/32.png) [@no\_way](https://forums.percona.com/u/no_way)\
**Post date:** [January 4, 2023, 3:19pm UTC](https://forums.percona.com/t/fluentbit-retrieve-slow-logs-from-pxc/19458/1 "2023-01-04T15:19:53Z")

</div>

Hello,

I’ve setup slow logs to my pxe cluster, I’ve access them inside container :

```auto
bash-4.4$ tail -f /var/lib/mysql/db-pxc-db-pxc-0-slow.log

# Time: 2023-01-04T13:00:05.776667Z
# User@Host: root[root] @ 10-10-0-2.db-pxc-db-haproxy-replicas.svc.cluster.local [10.10.0.2] Id: 67708
# Schema: Last_errno: 0 Killed: 0
# Query_time: 2.000123 Lock_time: 0.000000 Rows_sent: 1 Rows_examined: 1 Rows_affected: 0 Bytes_sent: 63
SET timestamp=1672837203;
select sleep(20);

```

and outside container :

```auto
kubectl -n db logs -f --since=1m pod/sb-pxc-db-pxc-0 logs
...
{"file":"/var/lib/mysql/db-pxc-db-pxc-0-slow.log","log":"# Time: 2023-01-04T13:03:14.860669Z"}
{"file":"/var/lib/mysql/db-pxc-db-pxc-0-slow.log","log":"# User@Host: root[root] @ db-pxc-db-haproxy-1.db-pxc-db-haproxy.db.svc.cluster.local [10.0.0.2] Id: 68939"}
{"file":"/var/lib/mysql/db-pxc-db-pxc-0-slow.log","log":"# Schema: Last_errno: 0 Killed: 0"}
{"file":"/var/lib/mysql/db-pxc-db-pxc-0-slow.log","log":"# Query_time: 2.000185 Lock_time: 0.000000 Rows_sent: 1 Rows_examined: 1 Rows_affected: 0 Bytes_sent: 63"}
{"file":"/var/lib/mysql/db-pxc-db-pxc-0-slow.log","log":"SET timestamp=1672837392;"}
{"file":"/var/lib/mysql/sb-pxc-db-pxc-0-slow.log","log":"select sleep(2);"}

```

I would like to have logs in one line to push it to ES, like actually parser configured :

```auto
cat /etc/fluentbit/parsers_multiline.conf 
[MULTILINE_PARSER]
    name multiline-regex-test
    type regex
    flush_timeout 1000
    #
    # Regex rules for multiline parsing
    # ---------------------------------
    #
    # configuration hints:
    #
    # - first state always has the name: start_state
    # - every field in the rule must be inside double quotes
    #
    # rules | state name | regex pattern | next state
    # ------|---------------|--------------------------------------------
    rule "start_state" "/\d{2,4}\-\d{2,4}\-\d{2,4}T\d{2,4}\:\d{2,4}\:\d{2,4}\.\d{1,6}Z(.*)|\d{2,6} \d{2,4}\:\d{2,4}\:\d{2,4}(.*)/" "cont"
    rule "cont" "/^\D/" "cont"

```

I didn’t found any doc, just code like this in [cr.yaml](https://github.com/percona/percona-xtradb-cluster-operator/blob/main/deploy/cr.yaml)

```auto
logcollector:
    enabled: true
    image: perconalab/percona-xtradb-cluster-operator:main-logcollector
# configuration: |
# [OUTPUT]
# Name es
# Match *
# Host 192.168.2.3
# Port 9200
# Index my_index
# Type my_type

```

Thanks 🙂

---

<div class="post-metadata">

**Author:** ![no\_way](https://avatars.discourse-cdn.com/v4/letter/n/bb73d2/32.png) [@no\_way](https://forums.percona.com/u/no_way)\
**Post date:** [March 29, 2023, 6:55am UTC](https://forums.percona.com/t/fluentbit-retrieve-slow-logs-from-pxc/19458/2 "2023-03-29T06:55:27Z")

</div>

Hi,

Any helps please ? thanks