syslog parser plugin parses syslog generated logs. This plugin supports two RFC formats, RFC-3164 and RFC-5424.time_format"%b %d %H:%M:%S" for RFC-3164 protocol. If your log uses sub-second timestamp, change this parameter to "%b %d %H:%M:%S.%N".rfc5424_time_formatmessage_formatrfc3164, rfc5424 and auto. Default is rfc3164. If your syslog uses rfc5424, use rfc5424 instead.auto is useful when this parser receives both rfc3164 and rfc5424 message. syslog parser detects message format by using message prefix.with_priority<9>, set true. Default is false.in_syslog plugin because the file logs via syslog do not have <9> like priority prefix.parser_typerfc3164/rfc5424 format. Supported values are regexp and string. Both parsers generate the same record for the standard format.regexp does not work for your logs, consider string type instead.string parser because it is 2x faster than regexp. The default is regexp for existing users. Fluentd v2 will change the default to string parser.support_colonless_identparser_type is string. If your message does not contain the ident field, set false to avoid ident mismatch.pri, host, ident, pid and message are included in the event record. time is used for the event time.pri value is converted to the integer type.with_priority is false, ^\<(?<pri>[0-9]+)\> is removed from the pattern.pri, host, ident, pid, msgid, extradata and message are included in the event record. time is used for the event time.pri value is converted to the integer type.with_priority is false, \<(?<pri>[0-9]{1,3})\>[1-9]\d{0,2} is removed from the pattern.