# CONFIGURED BY ANSIBLE

# @timestamp is enough for logs - no time_key
# https://docs.fluentbit.io/manual/pipeline/parsers/configuring-parser
[PARSER]
    name   json_no_time
    format json

[PARSER]
    name   syslog_no_time
    format regex
    regex  /^(?<time>[^ ]* {1,2}[^ ]* [^ ]*) (?<host>[^ ]*) (?<ident>[a-zA-Z0-9_\/\.\-]*)(?:\[(?<pid>[0-9]+)\])?(?:[^\:]*\:)? *(?<message>.*)$/

# warning cannot use field names containing a dot
# https://docs.fluentbit.io/manual/pipeline/parsers/regular-expression
# validate with https://rubular.com/

@INCLUDE custom_parsers_*.conf