parsers.conf

[MULTILINE_PARSER]
    # Combine an HTTP POST into a single message
    name combine-http-post
    type regex
    #
    # Regex rules for multiline parsing
    # ---------------------------------
    #
    # configuration hints:
    #
    #  - first state always has the name: start_state
    #  - every field in the rule must be inside double quotes
    #
    # rules |   state name  | regex pattern                  | next state
    # ------|---------------|--------------------------------------------
    rule      "start_state"   "/^POST \S+ HTTP\/1\.1\r/"       "cont"
    rule      "cont"          "/.*/"                           "cont"

[PARSER]
    Name post-with-syslog
    Format regex
    Regex /^\<(?<pri>[0-9]{1,5})\>1 (?<time>[^ ]+) (?<host>[^ ]*) (?<ident>[^ ]+) \[(?<ptype>[^ ]+)\] - (?<message>.*)/m
    Time_Key time
    Time_Format %Y-%m-%dT%H:%M:%S.%L%z
    Time_Keep On

[PARSER]
    Name extract-gauge
    Format regex
    Regex /\[gauge@\d+ (?<gauge>[^\]]+)/m

[PARSER]
    Name extract-tags
    Format regex
    Regex /\[tags@\d+ (?<tags>[^\]]+)/m

[PARSER]
    # "remainder" is additional log data you might want to write your own parsers for.
    Name extract-remainder
    Format regex
    Regex /(\[(tags|gauge)@\d+ [^\]]+\])+\s*(?<message>.+)/m

[PARSER]
    # Extract probable-json object from remainder. Experimental!
    Name extract-json-object-from-message
    Format regex
    Regex /\d{2}:\d{2}:\d{2} (?<application_ident>\S+)\s+\|\s+(?<application_log>\{.*\})\s*$/m

[PARSER]
    Name string-to-json
    Format json