logstransformprocessor

Logs Transform Processor

Status
Stability	development: logs
Distributions	observiq, splunk, sumo
Issues
Code Owners	@djaglowski, @dehaansa

NOTE - This processor is experimental, with the intention that its functionality will be reimplemented in the transform processor in the future.

The logs transform processor can be used to apply log operators to logs coming from any receiver. Please refer to config.go for the config spec.

Examples:

processors:
  logstransform:
    operators:
      - type: regex_parser
        regex: '^(?P<time>\d{4}-\d{2}-\d{2}) (?P<sev>[A-Z]*) (?P<msg>.*)$'
        timestamp:
          parse_from: body.time
          layout: "%Y-%m-%d"
        severity:
          parse_from: body.sev

Refer to config.yaml for detailed examples on using the processor.