You can configure common options for all parsers that produce named fields.

Reserved Words for Field Names

Field names are restricted. The following names are reserved and cannot be used as field names.

  • event_type

  • hostname

  • source

  • text

Common Parser Options

Options in the following table can be used with all supported parsers.




The name of the base parser that this custom parser extends. It can be a built-in parser name or another customer parser name. This configuration key is mandatory.


Nested parsers specified as a JSON strings. Keys are the names of the field to apply the nested parser to and the value is the name of the parser to use for that field. Each nested parser is applied to the appropriate field decoded by the base parser. Field decoders are useful when the value of a field is a complex value, for example, a timestamp.


Renames extracted fields. Use a JSON string where keys are the original names of the fields and values are the new desired names of the fields. The field_decoder option is always applied before field_rename. The order of these options in the INI file is not important. For clarity, specify field_decoder first.


Name of the next parser to run. Allows multiple parsers to run sequentially on the same input.


Parsers process all consequent parsers defined by the next_parser keyword and may replace a field value already extracted by a previous parser.


A list of semicolon separated field names to remove from the event before it is delivered to the server. Field names are removed before event filtering is performed so that the field that you excluding during parsing cannot be used in the filter condition.


Yes or No option that enables debugging of a particular parser. With debugging enabled, the parser performs detailed logging of input it receives, the operation it performed and the result it produced. The option applies per-section, that is, only to the parser defined by the particular section.

The default value for debug is debug=no for parsers.