1[PARSER]
2 # aero logs are "|" separated with 10 fields
3 # Date|Time|PID|TID|Log Type|Component|Module|Source File|Source Line|Free Text
4 # https://confluence.ncr.com/pages/viewpage.action?spaceKey=Aero&title=Aero+Logging
5 Name aero
6 Format regex
7 Regex ^(?<date>[^ ]+)\|(?<time>[^ ]+)\|(?<PID>[^ ]+)\|(?<TID>[^ ]+)\|(?<level>[^ ]+)\|(?<component>[^ ]+)\|(?<module>[^ ]+)\|(?<sourcefile>[^ ]+)\|(?<sourceline>[^ ]+)\|(?<message>.*)$
8
9[PARSER]
10 Name json
11 Format json
12
13# ===
14# multi-line parsing
15# ===
16# SSCODeviceServer.log contains multi line log messages like this:
17# 2021-11-24 16:40:18.172 [RxComputationThreadPool-2] INFO c.n.s.d.s.BrokerCommunicationServiceImpl - Successfully sent message to broker. message:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
18# <Keylock xmlns="http://www.ncr.com/ssc/devserver/xmlpos/Keylock/">
19# <ARTSHeader ActionCode="Update" MessageType="Response">
20# <MessageID>44f9786f-e4c6-4873-b21d-ebcccfbf51e9</MessageID>
21# <DateTime>2021-11-24T16:39:40.918Z</DateTime>
22# <Response ResponseCode="OK">
23# <ResponseTimestamp>2021-11-24T16:40:18.168Z</ResponseTimestamp>
24# </Response>
25# <SensorID UnifiedPOS="Keylock">1</SensorID>
26# </ARTSHeader>
27# <KeylockBody>
28# <SetProperty>
29# <Response ResponseCode="OK"/>
30# <DeviceEnabled>true</DeviceEnabled>
31# </SetProperty>
32# </KeylockBody>
33#</Keylock>
34#, topic:scox/v1/retailer1/store2/2052434e-0000-0000-0000-057055590556/device/keylock/44f9786f-e4c6-4873-b21d-ebcccfbf51e9
35#
36[MULTILINE_PARSER]
37 # https://docs.fluentbit.io/manual/administration/configuring-fluent-bit/multiline-parsing#configurable-multiline-parsers
38 name sco-device-server-regex
39 type regex
40 flush_timeout 1000
41 #
42 # Regex rules for multiline parsing
43 # ---------------------------------
44 #
45 # configuration hints:
46 #
47 # - first state always has the name: start_state
48 # - every field in the rule must be inside double quotes
49 #
50 # rules | state name | regex pattern | next state
51 # ------|---------------|--------------------------------------------
52 rule "start_state" "/(<\?xml)(.*)/" "cont"
53 rule "cont" "/^\s+<.*/" "cont"
54 rule "cont" "/^<.*/" "cont"
55 rule "cont" "/^,.*/" "cont"
View as plain text