Options
All
  • Public
  • Public/Protected
  • All
Menu

Namespace UnifiedAgentGrokParser

Grok parser.

Properties

Methods

Properties

Optional fieldTimeKey

fieldTimeKey: undefined | string

Specifies the time field for the event time. If the event doesn't have this field, the current time is used.

Optional grokFailureKey

grokFailureKey: undefined | string

Grok failure key.

Optional grokNameKey

grokNameKey: undefined | string

Grok name key.

Optional isEstimateCurrentEvent

isEstimateCurrentEvent: undefined | false | true

If true, use Fluent::EventTime.now(current time) as a timestamp when the time_key is specified.

Optional isKeepTimeKey

isKeepTimeKey: undefined | false | true

If true, keep the time field in the record.

Optional isNullEmptyString

isNullEmptyString: undefined | false | true

If true, an empty string field is replaced with a null value.

Optional nullValuePattern

nullValuePattern: undefined | string

Specify the null value pattern.

Const parserType

parserType: string = "GROK"

patterns

patterns: Array<GrokPattern>

Grok pattern object.

Optional timeoutInMilliseconds

timeoutInMilliseconds: undefined | number

Specify the timeout for parse processing. This is mainly for detecting an incorrect regexp pattern. Note: Numbers greater than Number.MAX_SAFE_INTEGER will result in rounding issues.

Optional types

types: undefined | object

Specify types for converting a field into another type. For example, With this configuration: @type csv keys time,host,req_id,user time_key time

This incoming event: \"2013/02/28 12:00:00,192.168.0.1,111,-\"

is parsed as: 1362020400 (2013/02/28/ 12:00:00)

record: { \"host\" : \"192.168.0.1\", \"req_id\" : \"111\", \"user\" : \"-\" }

Methods

getDeserializedJsonObj

getJsonObj