test.toml

[transforms.json_pipe_in]
    type = 'field_filter'
    inputs = ["syslog_pipe_out"]
    field = "target_format"
    value = "json"

[transforms.json_parser]
    type = "json_parser"
    inputs = ["json_pipe_in"]
    drop_invalid = true

[transforms.json_nginx_pipe_in]
    type = 'field_filter'
    inputs = ["json_parser"]
    field = "target_parser"
    value = "nginx"

[transforms.json_nginx_parser]
    type = "regex_parser"
    inputs = ["json_nginx_pipe_in"]
    field = "http.nginx_request"
    regex = "(?P<__http_request_method>[a-zA-Z]+) (?P<__http_path>[^\\?]+)(\\?(?P<__http_query>.+))? HTTP/1.1"
    drop_failed = false
    drop_field = false
    
[transforms.json_traefik_pipe_in]
    type = 'field_filter'
    inputs = ["json_parser"]
    field = "target_parser"
    value = "traefik"

[transforms.json_traefik_field_remap]
    type = "lua"
    inputs = ["json_traefik_pipe_in"]

    source = """
event["RequestProtocol"] = nil
event["RequestLine"] = nil

event["timestamp"] = event["time"]
event["time"] = nil

if event["msg"] ~= nil then
    event["event"] = event["msg"]
    event["msg"] = nil
end


event["http.response_length"] = event["traefik.OriginContentSize"]
event["http.request_method"] = event["traefik.RequestMethod"]
event["http.referrer"] = event["traefik.request_Referer"]
event["http.user_agent"] = event["traefik.request_User-Agent"]
event["http.status"] = event["traefik.OriginStatus"]
event["http.remote_address"] = event["traefik.ClientHost"]
if event["traefik.Duration"] ~= nil then
    event["http.request_time"] = tonumber(event["traefik.Duration"]) / 1000000000
else
    event["traefik.Duration"] = nil
end

for key, _ in pairs(event) do
    if key:lower() ~= key then
        event["traefik." .. key] = event[key]
        event[key] = nil
    end
end
"""