fluent-multi-parser: error="parse/@type is required

[Alicia Smith]

I'm using td-agent on CentOS 7

I have to use fluent-plugin-amqp version 0.11 which requires fluent 0.14 and am trying to figure out how multi-format-parser should be configured.



I'm getting the following:
2017-03-24 22:31:37 +0000 [error]: config error file="/etc/td-agent/td-agent.conf" error_class=Fluent::ConfigError error="parse/@type is required."

I am of the opinion that @type is required under <parse> - any help is appreciated!

This is my config:

<source>
  @type tail
  path /var/log/syslog/systems/*.log
  pos_file /var/log/td-agent/fluent-systems.pos
  exclude_path ["/var/log/syslog/systems/*.gz", "/var/log/syslog/systems/*.bz2"]
  tag syslog
  keep_time_key true
  refresh_interval 5
</source>

<filter syslog>
  @type parser
  key_name message
  reserve_time true
  <parse>
    @type multi_format
    # Pattern #1: entries with a Severity with regexp
    <pattern>
      format regexp
      expression /^(?<time>[^ ]*\s*[^ ]*\s*\d+:\d+:\d+)*\s*(?<host>[^ ]*)\s*(?<severity>[^ ]*)\s*(?<ident>[^ ]*)\s*(?<pid>[^ ]*)\s*(?<message>.*)$/
    </pattern>
    # Pattern #2: Entries without Severity with regexp
    <pattern>
      format regexp
      format /^(?<time>[^ ]*\s*[^ ]*\s*\d+:\d+:\d+)*\s*(?<host>[^\s]*)\s*(?<ident>[^\[]*)(?<pid>[^\s:]*)\s*:(?<message>.*)$/
    </pattern>
  </parse>
</filter>

[Mr. Fiber]

> fluent 0.14 and am trying to figure out how multi-format-parser should be configured.

No, the problem is in_tail.

in_tail needs <parse> section in v0.14 configuration.

I'm not sure why you don't use multi-format-parser in in_tail.

In your case, parser filter seems to be not needed.

Masahiro

--
You received this message because you are subscribed to the Google Groups "Fluentd Google Group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to fluentd+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Alicia Smith]

Hi Mr. Fiber!

I was using it that way because the example on the readme page for .14 shows it in the filter section
https://github.com/repeatedly/fluent-plugin-multi-format-parser

I did get this to working by moving it to in_tail as you said - it works beautifully!

Thank you!

Alicia

--
You received this message because you are subscribed to a topic in the Google Groups "Fluentd Google Group" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/fluentd/vq6CQXUmjVI/unsubscribe.
To unsubscribe from this group and all its topics, send an email to fluentd+unsubscribe@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

--

Alicia Smith

@phrozyn
Information Security Engineer

asm...@mozilla.com