Fluentd: Multiple formats in one match

问题

I'm new to Fluentd. I have one problem regarding the <match> tag and its format. For example

• Our system returns 2 different formats: format1, and format2 at the same tag: tag
• Using fluent.conf we are able to catch the provided tag but we are unable to separate those two formats

I tried the fluent-plugin-multi-format-parser but it does not allow me to add the prefixes.

<match tag>
    @type parser
    format multi

    <pattern>
         format format1
         add_prefix pattern1
         ... 
    </pattern> 

    <pattern>
         format format2
         add_prefix pattern2
         ... 
    </pattern>
</match>

Is there any work-around solution for this?

回答1:

I think the answer in this Google Groups conversation has a solution:

Specifically (incase the link doesn't work and to save time for those less interested):

For your purpose, you can use copy plugin. Copy the entire message, and then filter like:

<match tag>
  type copy
  <store>
    type grep
    input_key format_type
    regexp pattern1
    add_tag_prefix pattern1
  </store>
  <store>
    type grep
    input_key format_type
    regexp pattern2
    add_tag_prefix pattern2
  </store>
</match>
<match pattern1.tag>
</match>
<match pattern2.tag>
</match>

The input_key needs to be the key to run the regexp against.

来源：https://stackoverflow.com/questions/39991165/fluentd-multiple-formats-in-one-match