regexp
parser plugin parses logs by given regexp pattern. The regexp must have at least one named capture (?<NAME>
PATTERN). If the regexp has a capture named time
, this is configurable via time_key
parameter, it is used as the time of the event. You can specify the time format using the time_format
parameter.expression
i
and m
suffix.i
(ignorecase)m
(multiline)both
i
and m
.expression
is the string type before 1.2.0.ignorecase
i
option with expression.expression /pattern/i
instead.multiline
.
matches the newline. See Ruby's Regexp. Use m
option with expression.expression /pattern/m
instead.in_tail
editor helps your regexp testing. Another way, Fluentular is a great website to test your regexp for Fluentd configuration.fluentd-ui
instead.