Parsing transforms log content into meaningful values and structured data. Those values can enrich event payloads, support routing, trigger notifications, and prevent sensitive information from leaving an application. section 6.2
Use parsed values to:
- Build destination-specific structured payloads from unstructured events. section 6.2
- Route errors using values such as error codes, exception types, and packages. section 6.2
- Send security-related events to application repositories and security-monitoring tools. section 6.2
- Remove or mask sensitive values, including payment-card and bank-account details, before transmission. section 6.2
In Fluent Bit, parsing is performed through a parser filter. Parser definitions live in one or more files named by parsers_file in [SERVICE]. Each definition uses [PARSER], a unique name, and a format; chained parser files are possible when one parser feeds another. section 6.3
Attach a parser to an input
A parser configuration can define a regex parser, while a filter selects it for matching events: set parsers_file in [SERVICE], use name parser in [FILTER], identify the source field with key_name log, and select the definition with parser apache. preserve_key and reserve_data control whether original and unparsed data remain. section 6.3
Listing 6.1 Example parser file: parsers.conf
[PARSER] name myApache #1 format regex #2 regex ^(?<INT>[^ ]+) (?<FLOAT>[^ ]+) (?<BOOL>[^ ]+) (?<STRING>.+)$ #3
Inspect a compact parser definition using named regex captures for integer, floating-point, Boolean, and string values. section 6.3
