Parsing nginx error log through fluentd
@serut has a pretty good solution at the bottom of this Github issue: https://github.com/fluent/fluentd/issues/2991
# Use NGINX parse for front logs<label @PARSENGINX> <filter front> @type parser key_name message <parse> @type nginx </parse> </filter> <filter front> # Handle errors @type parser key_name message <parse> @type regexp expression /^(?<logtime>\d{4}\/\d{1,2}\/\d{1,2} \d{1,2}:\d{1,2}:\d{1,2}) (?<log_level>\[[^\s]+\]) (?<message>.*)$/ time_key logtime time_format %Y/%m/%d %H:%M:%S </parse> </filter> <match **> @type copy <store> @type relabel @label @OUTPUT </store> </match></label>