Parse Processor

Also known as NCSA Common log format.

This format is the basis for Apache Common Log and will work for Apache logs (not Apache Error logs however).

This parser allows a user to define a grok expression for parsing unstructured data based on a desired output format.

Note that the following literals are allowed between expressions, but otherwise you should use %{DATA} and %{GREEDYDATA} for data between expressions.

Allowed literal characters:\s,;:-

This accepts any JSON that came in as a text string to make it explicitly JSON.

Note that you might also need to use this if JSON is embedded within a message, such as inside of a syslog event.

Converts a string number into a numeric value.

This can be used to parse hexadecimal, octal, and binary numbers into a base 10 format.

This allows the user to enter a custom regular expression to be used in matching text within an unstructured text or line.

Note that this is a special feature that must be turned on by request. Please try to use grok first as it is often a faster and safer way to extract data from unstructured text.

This parser separates a string of words based on the contained whitespace and text references.

• Text delimited by whitespace
• Text delimited by double quotes: ".."
• Text delimited by square brackets: [..]

Note that the quotes and brackets can be escaped with a backslash (\).

This parser can be applied towards any text that includes a separated set of delimiters against a string. It includes:

1. A key delimiter - the character that separates the key and the value
2. The field delimiter - the character that separates the key / value pairs

This can be useful for logfmt and other types of data that are within a string, but have a defined delimiter.

This parser allows you to define a parsing expression to be used against timestamp strings that are ingested within logs.

Timestamp parsing expressions are evaluated based on the [strftime format](strftime format). Common preset expressions are included for ease of use.