The ltsv parser plugin parses LTSV format.

Parameters

See Parse section configurations​

delimiter

The delimiter character (or string) of TSV values

delimiter_pattern

The delimiter pattern of TSV values. This paramter overwrites delimiter paramter if specified.

delimiter_pattern is string type before 1.2.0.

label_delimiter

The delimiter character between field name and value

Example for LTSV

time:2013/02/28 12:00:00\thost:192.168.0.1\treq_id:111\tuser:-

This incoming event is parsed as:

time:
1362020400 (2013/02/28/ 12:00:00)
​
record:
{
  "host"   : "192.168.0.1",
  "req_id" : "111",
  "user"   : "-"
}

If you set null_value_pattern '-' in the configuration, user field becomes nil instead of "-".

Example with delimiter_pattern

Incoming event:

timestamp=1362020400 host=192.168.0.1  req_id=111 user=-

Configuration to parse above incoming event:

<parse>
  @type ltsv
  delimiter_pattern /\s+/
  label_delimiter =
</parse>

The incoming event is parsed as:

record:
{
  "timestamp": "1362020400",
  "host"     : "192.168.0.1",
  "req_id"   : "111",
  "user"     : "-"
}

If this article is incorrect or outdated, or omits critical information, please let us know. Fluentd is a open source project under Cloud Native Computing Foundation (CNCF). All components are available under the Apache 2 License.