Parsers

    The parser engine is fully configurable and can process log entries based in two types of format:

    By default, Fluent Bit provides a set of pre-configured parsers that can be used for different use cases such as logs from:

    • Nginx
    • Docker
    • Syslog rfc3164

    Parsers are defined in one or multiple configuration files that are loaded at start time, either from the command line or through the main Fluent Bit configuration file.

    Multiple parsers can be defined and each section have it own properties. The following table describes the available options for each parser definition:

    All parsers must be defined in a parsers.conf file, not in the Fluent Bit global configuration file. The parsers file expose all parsers available that can be used by the Input plugins that are aware of this feature. A parsers file can have multiple entries like this:

    For more information about the parsers available, please refer to the default parsers file distributed with Fluent Bit source code:

    Time resolution and it format supported are handled by using the strftime(3) libc system function.

    In addition, we extended our time resolution to support fractional seconds like 2017-05-17T15:44:31.187512963Z. Since Fluent Bit v0.12 we have full support for nanoseconds resolution, the %L format option for Time_Format is provided as a way to indicate that content must be interpreted as fractional seconds.