-
Notifications
You must be signed in to change notification settings - Fork 1
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Parser doesn't work with fluent-plugin-multi-format-parser #4
Comments
An AWS CloudWatch engineer we've been working on this with discovered the source of the problem:
Adding a link to a tagged version so that the file doesn't change out from under the previous link: https://github.com/repeatedly/fluent-plugin-multi-format-parser/blob/v1.0.0/lib/fluent/plugin/parser_multi_format.rb#L31 |
When this parser is configured as a subparser under the multi-format parser plugin, it doesn't work. Adding -v and -vv to fluentd produces no additional logs indicating why.
I am running fluentd 1.4 (from the official Docker container fluent/fluentd:v1.4-debian) and adding the two plugins like so:
Here's an example of the key-value format I'm trying to parse:
This log format works when I pass it to the keyvalue parser directly with this configuration:
However, this is only one of several formats that log messages from this
<source>
may have, so I am trying to nest this parser as one of several under the multi-format parser, and that's not working. I have tried with two different configurations, which break in different ways.In this configuration, messages always pass through the keyvalue parser directly to the JSON parser, even if they plainly match. There are no log messages from fluentd about why this is happening.
Here, I cut out the other parsers to see if I could get more information about why the keyvalue parser is failing, and I do: the message doesn't match, and fluentd logs a
pattern not match
error message, even though the event plainly matches.I'm not sure whether the problem is with this plugin, the multi-format plugin, or just my configuration.
The text was updated successfully, but these errors were encountered: