Versions | v0.14 (td-agent3) | v0.12 (td-agent2) | v0.10 (td-agent1)

Text Formatter Overview

Fluentd has 6 types of plugins: Input, Parser, Filter, Output, Formatter and Buffer. This article gives an overview of Formatter Plugin.

Table of Contents

Overview

Sometimes, the output format for an output plugin does not meet one’s needs. Fluentd has a pluggable system called Text Formatter that lets the user extend and re-use custom output formats.

How To Use

For an output plugin that supports Text Formatter, the format parameter can be used to change the output format.

For example, by default, out_file plugin outputs data as

2014-08-25 00:00:00 +0000<TAB>foo.bar<TAB>{"k1":"v1", "k2":"v2"}

However, if you set format json like this

<match foo.bar>
  @type file
  path /path/to/file
  format json
</match>

The output changes to

{"time": "2014-08-25 00:00:00 +0000", "tag":"foo.bar", "k1:"v1", "k2":"v2"}

i.e., each line is a single JSON object with “time” and “tag fields to retain the event’s timestamp and tag.

See this section to learn how to develop a custom formatter.

List of Built-in Formatters

out_file

Output time, tag and json record separated by a delimiter:

time[delimiter]tag[delimiter]record\n

Example:

2014-06-08T23:59:40[TAB]file.server.logs[TAB]{"field1":"value1","field2":"value2"}\n

out_file format has several options to customize the format.

delimiter SPACE   # Optional, SPACE or COMMA. "\t"(TAB) is used by default
output_tag false  # Optional, defaults to true. Output the tag field if true.
output_time true  # Optional, defaults to true. Output the time field if true.

For this format, the following common parameters are also supported.

  • include_time_key (Boolean, Optional, defaults to false) If true, the time field (as specified by the time_key parameter) is kept in the record.
  • time_key (String, Optional, defaults to “time”) The field name for the time key.
  • time_format (String. Optional) By default, the output format is iso8601 (e.g. “2008-02-01T21:41:49”). One can specify their own format with this parameter.
  • include_tag_key (Boolean. Optional, defaults to false) If true, the tag field (as specified by the tag_key parameter) is kept in the record.
  • tag_key (String, Optional, defaults to “tag”) The field name for the tag key.
  • localtime (Boolean. Optional, defaults to true) If true, use local time. Otherwise, UTC is used. This parameter is overwritten by the utc parameter.
  • timezone (String. Optional) By setting this parameter, one can parse the time value in the specified timezone. The following formats are accepted:

    1. [+-]HH:MM (e.g. “+09:00”)
    2. [+-]HHMM (e.g. “+0900”)
    3. [+-]HH (e.g. “+09”)
    4. Region/Zone (e.g. “Asia/Tokyo”)
    5. Region/Zone/Zone (e.g. “America/Argentina/Buenos_Aires”)

    The timezone set in this parameter takes precedence over localtime, e.g., if localtime is set to true but timezone is set to +0000, UTC would be used.

json

Output a json record without the time or tag field:

{"field1":"value1","field2":"value2"}\n

For this format, the following common parameters are also supported.

  • include_time_key (Boolean, Optional, defaults to false) If true, the time field (as specified by the time_key parameter) is kept in the record.
  • time_key (String, Optional, defaults to “time”) The field name for the time key.
  • time_format (String. Optional) By default, the output format is iso8601 (e.g. “2008-02-01T21:41:49”). One can specify their own format with this parameter.
  • include_tag_key (Boolean. Optional, defaults to false) If true, the tag field (as specified by the tag_key parameter) is kept in the record.
  • tag_key (String, Optional, defaults to “tag”) The field name for the tag key.
  • localtime (Boolean. Optional, defaults to true) If true, use local time. Otherwise, UTC is used. This parameter is overwritten by the utc parameter.
  • timezone (String. Optional) By setting this parameter, one can parse the time value in the specified timezone. The following formats are accepted:

    1. [+-]HH:MM (e.g. “+09:00”)
    2. [+-]HHMM (e.g. “+0900”)
    3. [+-]HH (e.g. “+09”)
    4. Region/Zone (e.g. “Asia/Tokyo”)
    5. Region/Zone/Zone (e.g. “America/Argentina/Buenos_Aires”)

    The timezone set in this parameter takes precedence over localtime, e.g., if localtime is set to true but timezone is set to +0000, UTC would be used.

hash

Output a record as ruby hash without the time or tag field:

{"field1"=>"value1","field2"=>"value2"}\n

For this format, the following common parameters are also supported.

  • include_time_key (Boolean, Optional, defaults to false) If true, the time field (as specified by the time_key parameter) is kept in the record.
  • time_key (String, Optional, defaults to “time”) The field name for the time key.
  • time_format (String. Optional) By default, the output format is iso8601 (e.g. “2008-02-01T21:41:49”). One can specify their own format with this parameter.
  • include_tag_key (Boolean. Optional, defaults to false) If true, the tag field (as specified by the tag_key parameter) is kept in the record.
  • tag_key (String, Optional, defaults to “tag”) The field name for the tag key.
  • localtime (Boolean. Optional, defaults to true) If true, use local time. Otherwise, UTC is used. This parameter is overwritten by the utc parameter.
  • timezone (String. Optional) By setting this parameter, one can parse the time value in the specified timezone. The following formats are accepted:

    1. [+-]HH:MM (e.g. “+09:00”)
    2. [+-]HHMM (e.g. “+0900”)
    3. [+-]HH (e.g. “+09”)
    4. Region/Zone (e.g. “Asia/Tokyo”)
    5. Region/Zone/Zone (e.g. “America/Argentina/Buenos_Aires”)

    The timezone set in this parameter takes precedence over localtime, e.g., if localtime is set to true but timezone is set to +0000, UTC would be used.

ltsv

Output the record as LTSV:

field1[label_delimiter]value1[delimiter]field2[label_delimiter]value2\n

ltsv format supports delimiter and label_delimiter options.

format ltsv
delimiter SPACE   # Optional. "\t"(TAB) is used by default
label_delimiter = # Optional. ":" is used by default

For this format, the following common parameters are also supported.

  • include_time_key (Boolean, Optional, defaults to false) If true, the time field (as specified by the time_key parameter) is kept in the record.
  • time_key (String, Optional, defaults to “time”) The field name for the time key.
  • time_format (String. Optional) By default, the output format is iso8601 (e.g. “2008-02-01T21:41:49”). One can specify their own format with this parameter.
  • include_tag_key (Boolean. Optional, defaults to false) If true, the tag field (as specified by the tag_key parameter) is kept in the record.
  • tag_key (String, Optional, defaults to “tag”) The field name for the tag key.
  • localtime (Boolean. Optional, defaults to true) If true, use local time. Otherwise, UTC is used. This parameter is overwritten by the utc parameter.
  • timezone (String. Optional) By setting this parameter, one can parse the time value in the specified timezone. The following formats are accepted:

    1. [+-]HH:MM (e.g. “+09:00”)
    2. [+-]HHMM (e.g. “+0900”)
    3. [+-]HH (e.g. “+09”)
    4. Region/Zone (e.g. “Asia/Tokyo”)
    5. Region/Zone/Zone (e.g. “America/Argentina/Buenos_Aires”)

    The timezone set in this parameter takes precedence over localtime, e.g., if localtime is set to true but timezone is set to +0000, UTC would be used.

single_value

Output the value of a single field instead of the whole record. Often used in conjunction with in_tail’s format none.

value1\n

single_value format supports the add_newline and message_key options.

add_newline false # Optional, defaults to true. If there is a trailing "\n" already, set it "false"
message_key my_field # Optional, defaults to "message". The value of this field is outputted.

csv

Output the record as CSV/TSV:

"value1"[delimiter]"value2"[delimiter]"value3"\n

csv format supports the delimiter and force_quotes options.

format csv
fields field1,field2,field3
delimiter \t   # Optional. "," is used by default.
force_quotes false # Optional. true is used by default. If false, value won't be framed by quotes.

For this format, the following common parameters are also supported.

  • include_time_key (Boolean, Optional, defaults to false) If true, the time field (as specified by the time_key parameter) is kept in the record.
  • time_key (String, Optional, defaults to “time”) The field name for the time key.
  • time_format (String. Optional) By default, the output format is iso8601 (e.g. “2008-02-01T21:41:49”). One can specify their own format with this parameter.
  • include_tag_key (Boolean. Optional, defaults to false) If true, the tag field (as specified by the tag_key parameter) is kept in the record.
  • tag_key (String, Optional, defaults to “tag”) The field name for the tag key.
  • localtime (Boolean. Optional, defaults to true) If true, use local time. Otherwise, UTC is used. This parameter is overwritten by the utc parameter.
  • timezone (String. Optional) By setting this parameter, one can parse the time value in the specified timezone. The following formats are accepted:

    1. [+-]HH:MM (e.g. “+09:00”)
    2. [+-]HHMM (e.g. “+0900”)
    3. [+-]HH (e.g. “+09”)
    4. Region/Zone (e.g. “Asia/Tokyo”)
    5. Region/Zone/Zone (e.g. “America/Argentina/Buenos_Aires”)

    The timezone set in this parameter takes precedence over localtime, e.g., if localtime is set to true but timezone is set to +0000, UTC would be used.

stdout

This format is aimed to be used by stdout plugins.

Output time, tag and formatted record as follows:

time tag: formatted_record\n

Example:

2015-05-02 12:12:17 +0900 tag: {"field1":"value1","field2":"value2"}\n

stdout format has a following option to customize the format of the record part.

output_type format # Optional, defaults to "json". The format of
`formatted_record`. Any formatter plugins can be specified.

For this format, the following common parameters are also supported.

  • include_time_key (Boolean, Optional, defaults to false) If true, the time field (as specified by the time_key parameter) is kept in the record.
  • time_key (String, Optional, defaults to “time”) The field name for the time key.
  • time_format (String. Optional) By default, the output format is iso8601 (e.g. “2008-02-01T21:41:49”). One can specify their own format with this parameter.
  • include_tag_key (Boolean. Optional, defaults to false) If true, the tag field (as specified by the tag_key parameter) is kept in the record.
  • tag_key (String, Optional, defaults to “tag”) The field name for the tag key.
  • localtime (Boolean. Optional, defaults to true) If true, use local time. Otherwise, UTC is used. This parameter is overwritten by the utc parameter.
  • timezone (String. Optional) By setting this parameter, one can parse the time value in the specified timezone. The following formats are accepted:

    1. [+-]HH:MM (e.g. “+09:00”)
    2. [+-]HHMM (e.g. “+0900”)
    3. [+-]HH (e.g. “+09”)
    4. Region/Zone (e.g. “Asia/Tokyo”)
    5. Region/Zone/Zone (e.g. “America/Argentina/Buenos_Aires”)

    The timezone set in this parameter takes precedence over localtime, e.g., if localtime is set to true but timezone is set to +0000, UTC would be used.

List of Output Plugins with Text Formatter Support

Last updated: 2015-12-01 21:20:32 UTC

Versions | v0.14 (td-agent3) | v0.12 (td-agent2) | v0.10 (td-agent1)

If this article is incorrect or outdated, or omits critical information, please let us know. Fluentd is a open source project under Cloud Native Computing Foundation (CNCF), invented and sponsored by Treasure Data, Inc. under the Apache 2.0 Licence.

Interested in the Fluentd Newsletters?