I would like to ask regarding to fluentd.

My fluentd versions is below.

fluentd 0.10.61

I now have a tail input plugin using multiple line format which parses multiple lines from log and set as a single record as below.

2016-07-31T14:48:06+09:00       arm       {"val1":"15:49:18.602384","val2":"5009","val3":"4896","val4":"3905","val5":"1811","val6":"10287","val7":"10271","val8":"1509","val9":"11064","val10":"10832","val11":"10673","val12":"9553","val13":"10660","val14":"9542","val15":"15:49:18.602509","val16":"3759","val17":"4758","val18":"2930","val19":"1261","val20":"7761","val21":"7767","val22":"1023","val23":"7905","val24":"7711","val25":"7918","val26":"7292","val27":"7940","val28":"6907"}

I will need to split all the fields from 1 record to 28 records for elasticsearch to recognize as different documents.

Like ,






Is there any way to achieve this in fluentd configuration ? Perhaps, embed ruby code?

Best Regards, Yu Watanabe


You need to provide a Regex to parse the fields separately and set the json part of the log message as the field message and the timestamp should be stored in the field time or @timestamp and it should work as you expect, where ElasticSearch interprets the json payload automatically.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.