You can configure common options for all parsers that produce named fields.

Field names are restricted. The following field names are reserved and cannot be used as field names.

  • event_type

  • hostname

  • source

  • text

Common Option

Description

base_parser

The name of the base parser that this custom parser extends. It can be a built-in parser name or another customer parser name. This configuration key is mandatory.

field_decoder

Nested parsers specified as a JSON string where keys are the names of the field to apply nested parser to and the value is the name of the parser to use for that field. Each nested parser is applied to the appropriate field decoded by the base parser. Field decoders are useful when the value of a field is a complex value, for example, a timestamp.

field_rename

Renames extracted fields. This is a JSON string where keys are the original names of the fields and values are the new desired names of the fields. Note that field_decoder is always applied before field_rename. The order of these options in the INI file is not important. For clarity, specify field_decoder first.

next_parser

Name of the next parser to run. Allows multiple parsers to run sequentially on the same input.

Note:

Parsers process all consequent parsers defined by the next_parser keyword and may replace a field value already extracted by a previous parser.

exclude_fields

A list of semicolon separated field names to remove from the event before it is delivered to the server. This is applied before event filtering is performed so that the field that you excluding during parsing cannot be used in the filter condition.

debug

Yes or No option that enables debugging of particular parser. With debugging enabled, the parser performs detailed logging of input it receives, the operation it performed and the result it produced. The option applies per-section, that is, only to the parser that is defined by the particular section.

The default value for debug is debug=no for parsers.