I am running ZooKeeper on a google compute instance and trying to setup google-cloud-ops-agent to properly parse the logs. I am most of the way there, but am having trouble getting it to recognize the severity field.
The docs state that severity is a special field that will get extracted from the jsonPayload, but I am not seeing that happening.
My /etc/google-cloud-ops-agent/config.yaml
logging:
receivers:
zookeeper:
type: files
include_paths:
- /zookeeper/logs/zookeeper.log
processors:
zookeeper:
type: parse_regex
field: message
regex: '^(?<time>.{23}) \[(?<zknode>[^\]]+)] - (?<severity>\S+)\s+ \[(?<class>[^\]]+)] - (?<msg>.*)$'
time_key: time
time_format: "%Y-%m-%d %H:%M:%S,%L"
service:
pipelines:
zookeeper:
receivers: [zookeeper]
processors: [zookeeper]
evidence the parse_regex is working properly (but notice severity still exists in jsonPayload)
