Skip to content

Instantly share code, notes, and snippets.

@rossigee
Created October 2, 2023 23:13
Show Gist options
  • Save rossigee/c0b837bdbb4bbac9ea7878084de76a71 to your computer and use it in GitHub Desktop.
Save rossigee/c0b837bdbb4bbac9ea7878084de76a71 to your computer and use it in GitHub Desktop.
Custom fluent-bit parsers for Ubuntu 20.04+
[PARSER]
Name ubuntu-syslog-with-pid
Format regex
Regex /^(?<timestamp>\S+\s+\d{1,2}\s+\d{2}:\d{2}:\d{2})\s(?<hostname>\S+)\s(?<process>\S+)\[(?<pid>\d+)\]:\s(?<message>.*)$/
Time_Key time
Time_Format %b %d %H:%M:%S
Time_Keep On
[PARSER]
Name ubuntu-syslog-without-pid
Format regex
Regex /^(?<timestamp>\S+\s+\d{1,2}\s+\d{2}:\d{2}:\d{2})\s(?<hostname>\S+)\s(?<process>\S+):\s(?<message>.*)$/
Time_Key time
Time_Format %b %d %H:%M:%S
Time_Keep On
[PARSER]
Name ubuntu-auth
Format regex
Regex /^(?<timestamp>\d+-\d+\s+\d+:\d+:\d+)\s+(?<message>.*)$/
Time_Key timestamp
Time_Format %Y-%m-%d %H:%M:%S
Time_Keep On
[INPUT]
Name tail
Path /var/log/syslog
Tag system.syslog
Parser ubuntu-syslog-with-pid
[INPUT]
Name tail
Path /var/log/auth.log
Tag system.auth
Parser ubuntu-syslog-with-pid
[INPUT]
Name tail
Path /var/log/dpkg.log
Tag system.dpkg
Parser ubuntu-dpkg
# Catch entries without the pid in brackets
[FILTER]
Name parser
Match system.syslog
Key_Name log
Parser ubuntu-syslog-without-pid
[FILTER]
Name parser
Match system.auth
Key_Name log
Parser ubuntu-syslog-without-pid
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment