fluentd source

fluentd_source.conf

<source>
  @type tail
  format /(?<schema>https?)://(?<domain>[^ ]*) (?<remote>[^ ]*) (?<host>[^ ]*) (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*?)(?: +\S*)?)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)") (?<message>.*) (?<resptime>\d+\.\d+)$/
  time_format %d/%b/%Y:%H:%M:%S %z
  types remote:string,host:string,user:string,time:time,method:string,path:string,code:integer,referer:string,agent:string,message:string,size:integer,resptime:float

  path /data/access.log
  pos_file /tmp/access_tail_pos.log
  tag es.demo.access
  read_lines_limit 1000
</source>