fluentd parsing syslog and get content only

user_3026781 0
Viewed 211

I use google-fluentd for sending logs to GCP. The problem is that GCP logging required the log as structured log which is JSON log. My service is already printing the log as structured log but it got prefix like timestamp, hostname, and service name which became an unstructured log. So, how do I parse syslog like below into structured log but just only the content without prefix?

before:

Nov 18 19:33:00 hostname-one service-name[909622]: {"timestamp":"2021-11-18T19:33:00.899671988+07:00","correlationId":"52e74b0d-bf41-4e41-ba8d-edc9f7062726","method":"POST","url":"/my/url","status":200,"responseTime":0.052602809}

after/expected:

{"timestamp":"2021-11-18T19:33:00.899671988+07:00","correlationId":"52e74b0d-bf41-4e41-ba8d-edc9f7062726","method":"POST","url":"/my/url","status":200,"responseTime":0.052602809}
fluentd google-cloud-platform logging
1 Answers

You can change the format to clean json by adding this to fluentd config file:

<format>
  @type json
</format>

There's more information about configuring output in fluentd documentation.

user_146634970
Related