regexp parser plugin parses logs by given regexp pattern. The regexp must have at least one named capture (?<NAME>PATTERN). If the regexp has a capture named time, this is configurable via time_key parameter, it is used as the time of the event. You can specify the time format using the time_format parameter.expressioni and m suffix.i (ignorecase)m (multiline)bothi and m.expression is the string type before 1.2.0.ignorecasei option with expression.expression /pattern/i instead.multiline. matches the newline. See Ruby's Regexp. Use m option with expression.expression /pattern/m instead.in_tail editor helps your regexp testing. Another way, Fluentular is a great website to test your regexp for Fluentd configuration.fluentd-ui instead.