@@ -37,7 +37,24 @@ weight: 200
3737| local_time | bool | No | true | Ff true, use local time. Otherwise, UTC is used. This is exclusive with utc. <br > |
3838| utc | bool | No | false | If true, use UTC. Otherwise, local time is used. This is exclusive with localtime <br > |
3939| timezone | string | No | nil | Use specified timezone. one can parse/format the time value in the specified timezone. <br > |
40- | patterns | [ ] ParseSection | No | - | Only available when using type: multi_format<br >[ Parse Section] ( #Parse-Section ) <br > |
40+ | format | string | No | - | Only available when using type: multi_format<br > |
41+ | patterns | [ ] SingleParseSection | No | - | Only available when using type: multi_format<br >[ Parse Section] ( #Parse-Section ) <br > |
42+ ### Parse Section (single)
43+ | Variable Name | Type | Required | Default | Description |
44+ | ---| ---| ---| ---| ---|
45+ | type | string | No | - | Parse type: apache2, apache_error, nginx, syslog, csv, tsv, ltsv, json, multiline, none, logfmt<br > |
46+ | expression | string | No | - | Regexp expression to evaluate<br > |
47+ | time_key | string | No | - | Specify time field for event time. If the event doesn't have this field, current time is used.<br > |
48+ | null_value_pattern | string | No | - | Specify null value pattern.<br > |
49+ | null_empty_string | bool | No | - | If true, empty string field is replaced with nil<br > |
50+ | estimate_current_event | bool | No | - | If true, use Fluent::EventTime.now(current time) as a timestamp when time_key is specified.<br > |
51+ | keep_time_key | bool | No | - | If true, keep time field in the record.<br > |
52+ | types | string | No | - | Types casting the fields to proper types example: field1: type , field2: type <br > |
53+ | time_format | string | No | - | Process value using specified format. This is available only when time_type is string<br > |
54+ | time_type | string | No | string | Parse/format value according to this type available values: float, unixtime, string <br > |
55+ | local_time | bool | No | true | Ff true, use local time. Otherwise, UTC is used. This is exclusive with utc. <br > |
56+ | utc | bool | No | false | If true, use UTC. Otherwise, local time is used. This is exclusive with localtime <br > |
57+ | timezone | string | No | nil | Use specified timezone. one can parse/format the time value in the specified timezone. <br > |
4158| format | string | No | - | Only available when using type: multi_format<br > |
4259 #### Example ` Parser ` filter configurations
4360 ``` yaml
0 commit comments