Ambassador logs parse

[DmitrySpiel]

I am facing an issue with parsing ambassador logs. Issue is that ambassador pods are streaming logs to stdout and stderr and they are ending up at the same place, however they have a different formatting. Stdout are json-formatted correctly and parsed correctly on fluentd side.
stderr have different formats (even inside one stream):

1st type

2022-03-21 13:04:03 diagd VERSION INFO: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX: 127.0.0.1 "GET /ambassador/v0/diag/" 22ms 200 success

2nd type:
time="2022-03-21 13:04:01.6752" level=warning msg="search is nil, not indexing" func="github.com/datawire/apro/cmd/amb-sidecar/devportal/server.(*Server).IndexOpenAPIDocs" file="github.com/datawire/apro/cmd/amb-sidecar/devportal/server/server.go:107" CMD=amb-sidecar PID=15 THREAD=/devportal_fetcher subsystem=fetcher
`
and I cannot parse that due to the same location.
I am not sure of what to use here and even can fluentd help me with that, but may be you guys can direct me as to where to dig at.

Thanks in advance!

[agup006]

Hey @DmitrySpiel , you could probably use multi-format (https://github.com/repeatedly/fluent-plugin-multi-format-parser) if you have multiple formats

copying from the plugin you could use the following

<filter app.**>
  @type parser
  key_name message
  <parse>
    @type multi_format
    <pattern>
      format json
    </pattern>
    <pattern>
      format regexp
      expression /...your regexp pattern.../
    </pattern>
    <pattern>
      format none
    </pattern>
  </parse>
</filter>