In the fluentd input, I am using a parser in the syslog input plugin to break the messages using regular expression. After the separation, I am trying to parse one of the field again using the multi-format-parser.
Output after input plugin - {"field1":"abc", "field2":"xyz", "message":"{\"field3\":\"def\", \"field4\":\"ghi\"}"}
Output after multi-format-parser - {"field3":"def", "field4":"ghi"}
In the fluentd input, I am using a parser in the syslog input plugin to break the messages using regular expression. After the separation, I am trying to parse one of the field again using the multi-format-parser.
Output after input plugin - {"field1":"abc", "field2":"xyz", "message":"{\"field3\":\"def\", \"field4\":\"ghi\"}"} Output after multi-format-parser - {"field3":"def", "field4":"ghi"}
Is there a way to retain the actual fields also.