[PARSER]
    # aero logs are "|" separated with 10 fields 
    # Date|Time|PID|TID|Log Type|Component|Module|Source File|Source Line|Free Text
    # https://confluence.ncr.com/pages/viewpage.action?spaceKey=Aero&title=Aero+Logging
    Name   aero
    Format regex
    Regex  ^(?<date>[^ ]+)\|(?<time>[^ ]+)\|(?<PID>[^ ]+)\|(?<TID>[^ ]+)\|(?<level>[^ ]+)\|(?<component>[^ ]+)\|(?<module>[^ ]+)\|(?<sourcefile>[^ ]+)\|(?<sourceline>[^ ]+)\|(?<message>.*)$

[PARSER]
    Name        json
    Format      json

# ===
# multi-line parsing
# ===
# SSCODeviceServer.log contains multi line log messages like this:
# 2021-11-24 16:40:18.172 [RxComputationThreadPool-2] INFO  c.n.s.d.s.BrokerCommunicationServiceImpl - Successfully sent message to broker. message:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
# <Keylock xmlns="http://www.ncr.com/ssc/devserver/xmlpos/Keylock/">
#     <ARTSHeader ActionCode="Update" MessageType="Response">
#         <MessageID>44f9786f-e4c6-4873-b21d-ebcccfbf51e9</MessageID>
#         <DateTime>2021-11-24T16:39:40.918Z</DateTime>
#         <Response ResponseCode="OK">
#            <ResponseTimestamp>2021-11-24T16:40:18.168Z</ResponseTimestamp>
#        </Response>
#        <SensorID UnifiedPOS="Keylock">1</SensorID>
#    </ARTSHeader>
#    <KeylockBody>
#        <SetProperty>
#            <Response ResponseCode="OK"/>
#            <DeviceEnabled>true</DeviceEnabled>
#        </SetProperty>
#    </KeylockBody>
#</Keylock>
#, topic:scox/v1/retailer1/store2/2052434e-0000-0000-0000-057055590556/device/keylock/44f9786f-e4c6-4873-b21d-ebcccfbf51e9
#
[MULTILINE_PARSER]
    # https://docs.fluentbit.io/manual/administration/configuring-fluent-bit/multiline-parsing#configurable-multiline-parsers
    name          sco-device-server-regex
    type          regex
    flush_timeout 1000
    #
    # Regex rules for multiline parsing
    # ---------------------------------
    #
    # configuration hints:
    #
    #  - first state always has the name: start_state
    #  - every field in the rule must be inside double quotes
    #
    # rules |   state name  | regex pattern                  | next state
    # ------|---------------|--------------------------------------------
    rule      "start_state"   "/(<\?xml)(.*)/"  "cont"
    rule      "cont"          "/^\s+<.*/"        "cont"
    rule      "cont"          "/^<.*/"        "cont"
    rule      "cont"          "/^,.*/"        "cont"