diff options
Diffstat (limited to '')
| -rw-r--r-- | fluent-bit/tests/internal/data/parser/regex.conf | 234 |
1 files changed, 234 insertions, 0 deletions
diff --git a/fluent-bit/tests/internal/data/parser/regex.conf b/fluent-bit/tests/internal/data/parser/regex.conf new file mode 100644 index 00000000..5b340dc3 --- /dev/null +++ b/fluent-bit/tests/internal/data/parser/regex.conf @@ -0,0 +1,234 @@ +# Parser: no_year +# =============== +# the given format don't contain the Year, this is a common +# case on old Syslog implementations. +# +[PARSER] + Name no_year + Format regex + Regex ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$ + Time_Key time + Time_Format %b %d %H:%M:%S + Time_Keep On + +# Parser: no_year_N +# ================= +# Just for compatibility, check a string with no year but including Nanoseconds. +# +[PARSER] + Name no_year_N + Format regex + Regex ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$ + Time_Key time + Time_Format %b %d %H:%M:%S.%L + Time_Keep On + +# Parser: no_year_NC +# ================= +# Just for compatibility, check a string with no year but including Nanoseconds with comma as fractional separator. +# +[PARSER] + Name no_year_NC + Format regex + Regex ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$ + Time_Key time + Time_Format %b %d %H:%M:%S,%L + Time_Keep On + +# Parser: no_year_TZ +# ================= +# Time string with no year and including timezone +# +[PARSER] + Name no_year_TZ + Format regex + Regex ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$ + Time_Key time + Time_Format %b %d %H:%M:%S %z + Time_Keep On + +# Parser: no_year_N_TZ +# ==================== +# Time string with no year, nanoseconds and timezone +# +[PARSER] + Name no_year_N_TZ + Format regex + Regex ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$ + Time_Key time + Time_Format %b %d %H:%M:%S.%L %z + Time_Keep On + + +# Parser: no_year_NC_TZ +# ==================== +# Time string with no year, nanoseconds and timezone with comma as fractional separator. +# +[PARSER] + Name no_year_NC_TZ + Format regex + Regex ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$ + Time_Key time + Time_Format %b %d %H:%M:%S,%L %z + Time_Keep On + + +# Parser: default_UTC +# =================== +# Time string with timezone in UTC +# +[PARSER] + Name default_UTC + Format regex + Regex ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$ + Time_Key time + Time_Format %m/%d/%Y %H:%M:%S + Time_Keep On + +# Parser: default_UTC_Z +# ===================== +# Time string with timezone in UTC and ending Z +# +[PARSER] + Name default_UTC_Z + Format regex + Regex ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$ + Time_Key time + Time_Format %m/%d/%Y %H:%M:%SZ + Time_Keep On + +# Parser: default_UTC_N_Z +# ======================= +# Time string with timezone in UTC, nanoseconds and ending Z +# +[PARSER] + Name default_UTC_N_Z + Format regex + Regex ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$ + Time_Key time + Time_Format %m/%d/%Y %H:%M:%S.%LZ + Time_Keep On + +# Parser: default_UTC_NC_Z +# ======================= +# Time string with timezone in UTC, nanoseconds with comma as fractional separator and ending Z +# +[PARSER] + Name default_UTC_NC_Z + Format regex + Regex ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$ + Time_Key time + Time_Format %m/%d/%Y %H:%M:%S,%LZ + Time_Keep On + +# Parser: generic_TZ +# ================== +# Generic date with timezone +# +[PARSER] + Name generic_TZ + Format regex + Regex ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$ + Time_Key time + Time_Format %m/%d/%Y %H:%M:%S %z + Time_Keep On + +# Parser: generic +# =============== +# Generic date +# +[PARSER] + Name generic + Format regex + Regex ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$ + Time_Key time + Time_Format %m/%d/%Y %H:%M:%S + Time_Keep On + +# Parser: generic_N +# =============== +# Generic date with nanoseconds +# +[PARSER] + Name generic_N + Format regex + Regex ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$ + Time_Key time + Time_Format %m/%d/%Y %H:%M:%S.%L + Time_Keep On + +# Parser: generic_NC +# =============== +# Generic date with nanoseconds with comma as fractional separator +# +[PARSER] + Name generic_NC + Format regex + Regex ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$ + Time_Key time + Time_Format %m/%d/%Y %H:%M:%S,%L + Time_Keep On + +# Parser: generic_N_TZ +# ==================== +# Generic date with nanoseconds and timezone +# +[PARSER] + Name generic_N_TZ + Format regex + Regex ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$ + Time_Key time + Time_Format %m/%d/%Y %H:%M:%S.%L %z + Time_Keep On + +# Parser: generic_NC_TZ +# ==================== +# Generic date with nanoseconds with comma as fractional separator and timezone +# +[PARSER] + Name generic_NC_TZ + Format regex + Regex ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$ + Time_Key time + Time_Format %m/%d/%Y %H:%M:%S,%L %z + Time_Keep On + +# Parser: generic_NL_TZ +# ==================== +# Generic date with nanoseconds with colon as fractional separator and timezone +# +[PARSER] + Name generic_NL_TZ + Format regex + Regex ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$ + Time_Key time + Time_Format %m/%d/%Y %H:%M:%S:%L %z + Time_Keep On + + +# Parser: apache_error +# ==================== +# Apache error log time format +# +[PARSER] + Name apache_error + Format regex + Regex ^(?<key001>[^ ]*) (?<key002>[^ ]*) (?<time>.+)$ + Time_Key time + Time_Format %a %b %d %H:%M:%S.%L %Y + Time_Keep On + + + +# Parser: mysql_quoted_stuff +# ==================== +# Apache error log time format +# +[PARSER] + Name mysql_quoted_stuff + Format regex + Regex ^(?<time>.*?),(?<key001>.*)$ + Time_Key time + Time_Format %Y-%M-%S %H:%M:%S + Time_Keep On + Decode_Field_As mysql_quoted key001 |