Parse string to JSON in FluentD

Question

I have this log string:

2019-03-18 15:56:57.5522 | HandFarm | ResolveDispatcher | start resolving msg: 8

Please tell me how I can parse this string to JSON format in fluentd.conf? I need the following format:

{
  "timestamp"  : "2019-03-18 15:56:57.5522",
  "system"  : "HandFarm",
  "module": "ResolveDispatcher",
  "message": "start resolving msg: 8",
}

I tried to use standard formatters, nothing came of it..

Answer 1

You could use regexp parser and format events to JSON. Here is an example of mine where I am reading the input from log file tail(with same input as yours) and output to stdout. Let me know.

<source>
  @type tail
  path /tailsource/t.log
  pos_file /tailpos/t.log.pos
  read_from_head true
  tag temp
  <parse>
    @type regexp
    expression /^(?<timestamp>.*?)\s\| (?<system>.*?)\s\| (?<module>.*?)\s\| (?<message>.*)$/
  </parse>
</source>

<match>
  @type stdout
</match>

Here is sample output -

{"timestamp":"2019-03-18 15:56:57.5522","system":"HandFarm","module":"ResolveDispatcher","message":"start resolving msg: 8"}