apiVersion: fluentbit.fluent.io/v1alpha2
kind: ClusterParser
metadata:
  name: samhain
  labels:
    fluentbit.fluent.io/enabled: "true"
spec:
  regex:
    regex: ^(?<severity>DEBUG|INFO|NOTICE|WARN|MARK|ERROR|CRIT|ALERT)\s*:\s*\[(?<date>\d{4}-\d{2}-\d{2})T(?<time>\d{2}:\d{2}:\d{2}\+\d{4})\]\s*msg=<(?!EXIT|START)(?<message>.*?)>(?>,\s*)?(?<attributes>.*)$