Permalink
…nfig (#2134) Signed-off-by: Spike Wu <xwu@splunk.com>
[PARSER] | |
Name apache | |
Format regex | |
Regex ^(?<host>[^ ]*) [^ ]* (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*?)(?: +\S*)?)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)")?$ | |
Time_Key time | |
Time_Format %d/%b/%Y:%H:%M:%S %z | |
[PARSER] | |
Name apache2 | |
Format regex | |
Regex ^(?<host>[^ ]*) [^ ]* (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^ ]*) +\S*)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>.*)")?$ | |
Time_Key time | |
Time_Format %d/%b/%Y:%H:%M:%S %z | |
[PARSER] | |
Name apache_error | |
Format regex | |
Regex ^\[[^ ]* (?<time>[^\]]*)\] \[(?<level>[^\]]*)\](?: \[pid (?<pid>[^\]]*)\])?( \[client (?<client>[^\]]*)\])? (?<message>.*)$ | |
[PARSER] | |
Name nginx | |
Format regex | |
Regex ^(?<remote>[^ ]*) (?<host>[^ ]*) (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*?)(?: +\S*)?)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)") | |
Time_Key time | |
Time_Format %d/%b/%Y:%H:%M:%S %z | |
[PARSER] | |
# https://rubular.com/r/IhIbCAIs7ImOkc | |
Name k8s-nginx-ingress | |
Format regex | |
Regex ^(?<host>[^ ]*) - (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*?)(?: +\S*)?)?" (?<code>[^ ]*) (?<size>[^ ]*) "(?<referer>[^\"]*)" "(?<agent>[^\"]*)" (?<request_length>[^ ]*) (?<request_time>[^ ]*) \[(?<proxy_upstream_name>[^ ]*)\] (\[(?<proxy_alternative_upstream_name>[^ ]*)\] )?(?<upstream_addr>[^ ]*) (?<upstream_response_length>[^ ]*) (?<upstream_response_time>[^ ]*) (?<upstream_status>[^ ]*) (?<reg_id>[^ ]*).*$ | |
Time_Key time | |
Time_Format %d/%b/%Y:%H:%M:%S %z | |
[PARSER] | |
Name json | |
Format json | |
Time_Key time | |
Time_Format %d/%b/%Y:%H:%M:%S %z | |
[PARSER] | |
Name docker | |
Format json | |
Time_Key time | |
Time_Format %Y-%m-%dT%H:%M:%S.%L | |
Time_Keep On | |
# -- | |
# Since Fluent Bit v1.2, if you are parsing Docker logs and using | |
# the Kubernetes filter, it's not longer required to decode the | |
# 'log' key. | |
# | |
# Command | Decoder | Field | Optional Action | |
# =============|==================|================= | |
#Decode_Field_As json log | |
[PARSER] | |
Name docker-daemon | |
Format regex | |
Regex time="(?<time>[^ ]*)" level=(?<level>[^ ]*) msg="(?<msg>[^ ].*)" | |
Time_Key time | |
Time_Format %Y-%m-%dT%H:%M:%S.%L | |
Time_Keep On | |
[PARSER] | |
Name syslog-rfc5424 | |
Format regex | |
Regex ^\<(?<pri>[0-9]{1,5})\>1 (?<time>[^ ]+) (?<host>[^ ]+) (?<ident>[^ ]+) (?<pid>[-0-9]+) (?<msgid>[^ ]+) (?<extradata>(\[(.*?)\]|-)) (?<message>.+)$ | |
Time_Key time | |
Time_Format %Y-%m-%dT%H:%M:%S.%L%z | |
Time_Keep On | |
[PARSER] | |
Name syslog-rfc3164-local | |
Format regex | |
Regex ^\<(?<pri>[0-9]+)\>(?<time>[^ ]* {1,2}[^ ]* [^ ]*) (?<ident>[a-zA-Z0-9_\/\.\-]*)(?:\[(?<pid>[0-9]+)\])?(?:[^\:]*\:)? *(?<message>.*)$ | |
Time_Key time | |
Time_Format %b %d %H:%M:%S | |
Time_Keep On | |
[PARSER] | |
Name syslog-rfc3164 | |
Format regex | |
Regex /^\<(?<pri>[0-9]+)\>(?<time>[^ ]* {1,2}[^ ]* [^ ]*) (?<host>[^ ]*) (?<ident>[a-zA-Z0-9_\/\.\-]*)(?:\[(?<pid>[0-9]+)\])?(?:[^\:]*\:)? *(?<message>.*)$/ | |
Time_Key time | |
Time_Format %b %d %H:%M:%S | |
Time_Keep On | |
[PARSER] | |
Name mongodb | |
Format regex | |
Regex ^(?<time>[^ ]*)\s+(?<severity>\w)\s+(?<component>[^ ]+)\s+\[(?<context>[^\]]+)]\s+(?<message>.*?) *(?<ms>(\d+))?(:?ms)?$ | |
Time_Format %Y-%m-%dT%H:%M:%S.%L | |
Time_Keep On | |
Time_Key time | |
[PARSER] | |
# https://rubular.com/r/3fVxCrE5iFiZim | |
Name envoy | |
Format regex | |
Regex ^\[(?<start_time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*?)(?: +\S*)?)? (?<protocol>\S+)" (?<code>[^ ]*) (?<response_flags>[^ ]*) (?<bytes_received>[^ ]*) (?<bytes_sent>[^ ]*) (?<duration>[^ ]*) (?<x_envoy_upstream_service_time>[^ ]*) "(?<x_forwarded_for>[^ ]*)" "(?<user_agent>[^\"]*)" "(?<request_id>[^\"]*)" "(?<authority>[^ ]*)" "(?<upstream_host>[^ ]*)" | |
Time_Format %Y-%m-%dT%H:%M:%S.%L%z | |
Time_Keep On | |
Time_Key start_time | |
[PARSER] | |
# http://rubular.com/r/tjUt3Awgg4 | |
Name cri | |
Format regex | |
Regex ^(?<time>[^ ]+) (?<stream>stdout|stderr) (?<logtag>[^ ]*) (?<message>.*)$ | |
Time_Key time | |
Time_Format %Y-%m-%dT%H:%M:%S.%L%z | |
[PARSER] | |
Name kube-custom | |
Format regex | |
Regex (?<tag>[^.]+)?\.?(?<pod_name>[a-z0-9](?:[-a-z0-9]*[a-z0-9])?(?:\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*)_(?<namespace_name>[^_]+)_(?<container_name>.+)-(?<docker_id>[a-z0-9]{64})\.log$ |