syslog
parser plugin parses syslog
generated logs. This plugin supports two RFC formats, RFC-3164 and RFC-5424.time_format
"%b %d %H:%M:%S"
for RFC-3164 protocol. If your log uses sub-second timestamp, change this parameter to "%b %d %H:%M:%S.%N"
.rfc5424_time_format
message_format
rfc3164
, rfc5424
and auto
. Default is rfc3164
. If your syslog
uses rfc5424
, use rfc5424
instead.auto
is useful when this parser receives both rfc3164
and rfc5424
message. syslog
parser detects message format by using message prefix.with_priority
<9>
, set true
. Default is false
.in_syslog
plugin because the file logs via syslog
do not have <9>
like priority prefix.parser_type
rfc3164
/rfc5424
format. Supported values are regexp
and string
. Both parsers generate the same record for the standard format.regexp
does not work for your logs, consider string
type instead.string
parser because it is 2x faster than regexp
. The default is regexp
for existing users. Fluentd v2 will change the default to string
parser.support_colonless_ident
parser_type
is string
. If your message does not contain the ident field, set false
to avoid ident mismatch.pri
, host
, ident
, pid
and message
are included in the event record. time
is used for the event time.pri
value is converted to the integer type.with_priority
is false
, ^\<(?<pri>[0-9]+)\>
is removed from the pattern.pri
, host
, ident
, pid
, msgid
, extradata
and message
are included in the event record. time
is used for the event time.pri
value is converted to the integer type.with_priority
is false
, \<(?<pri>[0-9]{1,3})\>[1-9]\d{0,2}
is removed from the pattern.