td-agent.conf for Solr log for parsing query log.

td-agent.conf

<source>
  type tail
  path /opt/solr/solr-4.9.0/example/logs/solr.log
  pos_file /var/log/td-agent/solr.log.pos
  tag raw.solr.log
  format /^(?<loglevel>[^ ]*)  (?<hyp>[^ ]*) (?<time>[^ ]* [^ ]*) (?<class>[^ ]*) \[(?<core>[^ ]*)\] webapp=\/(?<webapp>[^ ]*) path=\/(?<path>[^ ]*) params={(?<params>[^ ]*)} hits=(?<hits>[^ ]*) status=(?<status>[^ ]*) QTime=(?<Qtime>[^ ]*) /
  time_format %Y-%m-%d %H:%M:%S.%L;
</source>

<match raw.solr.log>
 type fields_parser
 remove_tag_prefix raw
# add_tag_prefix debug
 parse_key params
# fields_key params
 pattern ([\w|\.]+)=([^ &]*)
</match>

<match solr.log>
 type elasticsearch
 type_name solr_log
 host localhost
 port 9200
 logstash_format true
 include_tag_key true
 tag_key @log_name
</match>