search

nom3ad / fluent-plugin-keyvalue-parser

Fluent parser plugin for key-value formatted logs.
https://rubygems.org/gems/fluent-plugin-keyvalue-parser
5 stars 1 forks source link

Adjustement Rules #2

Closed ClementDy closed 7 years ago

ClementDy commented 7 years ago

Hello,

I've some trouble to use multiple adjustement_rules

My syntax is : adjustment_rules {"key1":"(regex1)","keyX":"(regex1)","keyY":"(regex1)"} I precise that when i used only one adjustement_rules like that : adjustment_rules {"key":"(regex)"} that's work fine.

Can you give me more informations please, thanks for your job !

Regards

ClementDy commented 7 years ago

Hi,

I have fixed my problem, to facilitate the parsing i have changed my format syntax by using "" for my values.

Regards

nom3ad commented 7 years ago

can you please give me the samples of log you tried to parse and the adjustment_rules used. If any problem exists with _use of many adjustementrules i would like to fix it. regards,

ClementDy commented 7 years ago

The log was : DATE 2017-08-24 08:48:49 LEVEL INFO COMMENT [START_READING_CSV_FILE] FILE datas.csv BEGIN 2017-08-24 08:48:49

or : DATE 2017-08-24 08:49:43 LEVEL INFO COMMENT [ALL_DATA_WAS_READ] STATUS OK BEGIN 2017-08-24 08:48:49 END 2017-08-24 08:49:43

And the adjustement_rules : {"DATE": "(^.{19})","BEGIN": "(^.{19})","END": "(^.{19})"} I have tried a lot of regexs but everytime, the first key (DATE) was correctly parsed but not the rest.

But i think that the problem comes from my regex.

Regards