fluentd: add modern parsing config

To satisfy the needs of the modern parser plugin.

Needed-By: https://review.opendev.org/c/openstack/kolla/+/823071
Co-Authored-By: Dr. Jens Harbott <harbott@osism.tech>
Change-Id: I2b748d0544c14bebefe8c62aa5aafaaa5371ce53
This commit is contained in:
Radosław Piliszek 2021-12-28 14:15:58 +00:00
parent 1fd1f131e7
commit 1a3c4f1bbf
2 changed files with 14 additions and 0 deletions

View File

@ -7,4 +7,11 @@
time_key Timestamp
time_format %d/%b/%Y:%H:%M:%S %z
keep_time_key true
<parse>
@type grok
grok_pattern \[%{HTTPDATE:Timestamp}\] "(?:%{WORD:http_method} %{NOTSPACE:http_url}(?: HTTP/%{NUMBER:http_version})?|%{DATA:rawrequest})" %{NUMBER:http_status} (?:\d+|-)
time_key Timestamp
time_format %d/%b/%Y:%H:%M:%S %z
keep_time_key true
</parse>
</filter>

View File

@ -7,4 +7,11 @@
time_key Timestamp
time_format %d/%b/%Y:%H:%M:%S %z
keep_time_key true
<parse>
@type grok
grok_pattern %{IPORHOST:clientip} %{HTTPDUSER:ident} %{USER:auth} \[%{HTTPDATE:Timestamp}\] "(?:%{WORD:http_method} %{NOTSPACE:http_url}(?: HTTP/%{NUMBER:http_version})?|%{DATA:rawrequest})" %{NUMBER:http_status} (?:%{NUMBER:http_bytes}|-) (?:%{NUMBER:http_response_time_us}|-) %{QS:referrer} %{QS:agent}
time_key Timestamp
time_format %d/%b/%Y:%H:%M:%S %z
keep_time_key true
</parse>
</filter>