search

repeatedly / fluent-plugin-multi-format-parser

Multi format parser for Fluentd
108 stars 16 forks source link

Actual record overridden after parsing #10

Open kumaravel29 opened 6 years ago

kumaravel29 commented 6 years ago

In the fluentd input, I am using a parser in the syslog input plugin to break the messages using regular expression. After the separation, I am trying to parse one of the field again using the multi-format-parser.

Output after input plugin - {"field1":"abc", "field2":"xyz", "message":"{\"field3\":\"def\", \"field4\":\"ghi\"}"} Output after multi-format-parser - {"field3":"def", "field4":"ghi"}

Is there a way to retain the actual fields also.

repeatedly commented 6 years ago

If you use filter_parser plugin, consider https://docs.fluentd.org/v1.0/articles/filter_parser#reserve_data