# Default parser definitions are in fluent-bit-3.1.9-win64/conf/parsers.conf.
# Copy them into this file as necessary.
# Parsers should be arranged in alphabetical order by Name.

[PARSER]
    Name   apache2
    Format regex
    Regex  ^(?<host>[^ ]*) [^ ]* (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^ ]*) +\S*)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>.*)")?$
    Time_Key time
    Time_Format %d/%b/%Y:%H:%M:%S %z

[PARSER]
    Name   apache_error
    Format regex
    Regex  ^\[[^ ]* (?<time>[^\]]*)\] \[(?<level>[^\]]*)\](?: \[pid (?<pid>[^\]]*)\])?( \[client (?<client>[^\]]*)\])? (?<message>.*)$
    Time_key time
    Time_Format %b %d %H:%M:%S.%L %Y

[PARSER]
    Name cvr_access_log
    Format regex
    Regex ^(?<timestamp>\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{2}:\d{2}.\d{3}[^ ]+) (?<remoteIp>[^ ]+) (?:-|\((?<xForwardedFor>[^)]+)\)) > (?<localIp>[^:]+)(?<localPort>[^ ]+) "(?<requestFirstLine>[^"]+)" (?<duration>[^ ]+) (?<httpStatus>[^ ]+) (?<bytesSent>[^ ]+) "(?<thread>[^"]+)" "(?<referer>[^"]+)"$
    Time_Key timestamp
    Time_Format %Y-%m-%d %H:%M:%S.%L%Z
    Time_Keep On

[PARSER]
    Name cvr_catalina_log
    Format regex
    Regex ^(?<timestamp>\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{2}:\d{2}.\d{3})[^ ]+ +(?<level>[A-Za-z]+) (?<loggerName>[^,]+),(?<thread>[^:]+):[^ ]* (?<extraInfo>\{[^}]+\})?- (?<message>.*)$
    Time_Key timestamp
    Time_Format %Y-%m-%d %H:%M:%S.%L
    Time_Keep On

[PARSER]
    Name fnt_catalina_out_message
    Format regex
    Regex /^(?<timestamp>(?:\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{2}:\d{2} [+-]\d{4})|(?:\d{1,2}-\w{3}-\d{4} \d{1,2}:\d{2}:\d{2}\.\d{3})) (?<level>\w+) {1,2}\[(?<thread>[a-zA-Z0-9$._\-\[\]]+)\] ?(?<loggerName>[a-zA-Z0-9$._\-\[\]]+)? (?<message>[^\r\n]*)\r?\n(?:(?<extended_message>.+)\r?\n)?$/m
    Time_Key timestamp
    Time_Keep On

[PARSER]
    Name fnt_catalina_out_time1
    Format regex
    Regex /^(?<timestamp>\d{1,2}-\w{3}-\d{4} \d{1,2}:\d{2}:\d{2}\.\d{3})/m
    Time_Key timestamp
    Time_Format  %d-%b-%Y %H:%M:%S.%L
    Time_Keep On

[PARSER]
    Name fnt_catalina_out_time2
    Format regex
    Regex /^(?<timestamp>\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{2}:\d{2} [+-]\d{4})/m
    Time_Key timestamp
    Time_Format  %Y-%m-%d %H:%M:%S %z
    Time_Keep On

[PARSER]
    Name ftp_request
    Format regex
    Regex ^\[(?<timestamp>[^\]]+)\] (?<ipAddress>[0-9a-fA-F.:]+) (?<tlsVersion>[a-zA-Z0-9$._-]+) (?<tlsKey>[a-zA-Z0-9$._-]+) "(?<request>[^"]+)" (?<bytesSent>-|\d+) (?<agent_string>.*)$
    Time_Key timestamp
    Time_Format %d/%b/%Y:%H:%M:%S %z
    Time_keep On

[PARSER]
    Name hsw_text
    Format regex
    Regex /^(?<timestamp>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}[+-]\d{2}:\d{2}) (?<level>[^ ]+) \((?<priority>\d)\): *(?<message>[^\r\n]*)\r?\n(?:(?<extended_message>.+)\r?\n)?$/m
    Time_Key timestamp
    Time_Format  %Y-%m-%dT%H:%M:%S%z
    Time_Keep On

[PARSER]
    Name iis_server_w3c1
    Format regex
    Regex ^(?<message>#.+)|(?<timestamp>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}) (?<serviceName>[^ ]+) (?<serverName>[^ ]+) (?<serverIp>[0-9a-fA-F.:]+) (?<method>\w+) (?<uriStem>[^ ]+) (?<uriQuery>[^ ]+) (?<serverPort>[^ ]+) (?<userName>[^ ]+) (?<clientIp>[^ ]+) (?<httpVersion>[^ ]+) (?<userAgent>[^ ]+) (?<cookie>[^ ]+) (?<referrer>[^ ]+) (?<host>[^ ]+) (?<protocolStatus>[^ ]+) (?<subStatus>[^ ]+) (?<win32Status>[^ ]+) (?<bytesSent>[^ ]+) (?<bytesReceived>[^ ]+) (?<timeTaken>[^ ]+?)$
    Time_Key timestamp
    Time_Format  %Y-%m-%d %H:%M:%S
    Time_Keep On

[PARSER]
    Name iis_server_w3c2
    Format regex
    Regex ^(?<message>#.+)|(?<timestamp>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}) (?<serverIp>[0-9a-fA-F.:]+) (?<method>\w+) (?<uriStem>[^ ]+) (?<uriQuery>[^ ]+) (?<serverPort>[^ ]+) (?<userName>[^ ]+) (?<clientIp>[^ ]+) (?<userAgent>[^ ]+) (?<referrer>[^ ]+) (?<protocolStatus>[^ ]+) (?<subStatus>[^ ]+) (?<win32Status>[^ ]+) (?<timeTaken>[^ ]+?)$
    Time_Key timestamp
    Time_Format  %Y-%m-%d %H:%M:%S
    Time_Keep On

[PARSER]
    Name iis_server_w3c3
    Format regex
    Regex ^(?<message>#.+)|(?<timestamp>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}) (?<serverIp>[0-9a-fA-F.:]+) (?<method>\w+) (?<uriStem>[^ ]+) (?<uriQuery>[^ ]+) (?<serverPort>[^ ]+) (?<userName>[^ ]+) (?<clientIp>[^ ]+) (?<userAgent>[^ ]+) (?<referrer>[^ ]+) (?<protocolStatus>[^ ]+) (?<subStatus>[^ ]+) (?<win32Status>[^ ]+) (?<bytesSent>[^ ]+) (?<bytesReceived>[^ ]+) (?<timeTaken>[^ ]+?)$
    Time_Key timestamp
    Time_Format  %Y-%m-%d %H:%M:%S
    Time_Keep On

[PARSER]
    Name iis_server_w3c4
    Format regex
    Regex ^(?<message>#.+)|(?<timestamp>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}) (?<serverIp>[0-9a-fA-F.:]+) (?<method>\w+) (?<uriStem>[^ ]+) (?<uriQuery>[^ ]+) (?<serverPort>[^ ]+) (?<userName>[^ ]+) (?<clientIp>[^ ]+) (?<userAgent>[^ ]+) (?<referrer>[^ ]+) (?<host>[^ ]+) (?<protocolStatus>[^ ]+) (?<subStatus>[^ ]+) (?<win32Status>[^ ]+) (?<timeTaken>[^ ]+?)$
    Time_Key timestamp
    Time_Format  %Y-%m-%d %H:%M:%S
    Time_Keep On

[PARSER]
    Name iis_server_w3c5
    Format regex
    Regex ^(?<message>#.+)|(?<timestamp>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}) (?<serviceName>[^ ]+) (?<serverName>[^ ]+) (?<serverIp>[0-9a-fA-F.:]+) (?<method>\w+) (?<uriStem>[^ ]+) (?<uriQuery>[^ ]+) (?<serverPort>[^ ]+) (?<userName>[^ ]+) (?<clientIp>[^ ]+) (?<httpVersion>[^ ]+) (?<userAgent>[^ ]+) (?<referrer>[^ ]+) (?<host>[^ ]+) (?<protocolStatus>[^ ]+) (?<subStatus>[^ ]+) (?<win32Status>[^ ]+) (?<bytesSent>[^ ]+) (?<bytesReceived>[^ ]+) (?<timeTaken>[^ ]+?)$
    Time_Key timestamp
    Time_Format  %Y-%m-%d %H:%M:%S
    Time_Keep On

[PARSER]
    Name   json_no_timestamp
    Format json

[PARSER]
    Name    json_iso8601_t
    Format  json
    Time_Key  timestamp
    Time_Format  %Y-%m-%dT%H:%M:%S.%L%z

[PARSER]
    Name p4s_log
    Format regex
    Regex /^Perforce server info:\n\t?(?<timestamp>\d{4}\/\d{2}\/\d{2} \d{2}:\d{2}:\d{2})? pid (?<pid>\d+) *(?<message>[^\r\n]*)\r?\n(?:(?<extended_message>.+)\r?\n)?$/m
    Time_Key timestamp
    Time_Format %Y/%m/%d %H:%M:%S

[PARSER]
    Name keycloak_server
    Format regex
    Regex /^(?<timestamp>\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{2}:\d{2},\d{3}) (?<level>\w+) +\[(?<loggerName>[a-zA-Z0-9$._\-\[\]]+)\] \((?<thread>[a-zA-Z0-9$ ._\-\[\]]+)\) (?<message>[^\r\n]*)\r?\n(?:(?<extended_message>.+)\r?\n)?$/m
    Time_Key timestamp
    Time_Format  %Y-%m-%d %H:%M:%S,%L
    Time_Keep On

[PARSER]
    Name mongod_time
    Format regex
    Regex ^(?<timestamp>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3})
    Time_Key timestamp
    Time_Format  %Y-%m-%dT%H:%M:%S.%L
    Time_Keep On

[PARSER]
    Name proftpd_xferlog
    Format regex
    Regex ^\w{3}\s(?<timestamp>\w{3}\s\d{2}\s.+? \d{4})\s(?<transfer_time>[^ ]*) (?<remote_host>[^ ]*) (?<file_size>[^ ]*) (?<file_name>[^ ]*) (?<transfer_type>[^ ]*) (?<special_action_flag>[^ ]*) (?<direction>[^ ]*) (?<access_mode>[^ ]*) (?<username>[^ ]*) (?<service_name>[^ ]*) (?<authentication_method>[^ ]*) (?<authenticated_user_id>[^ ]*) (?<completion_status>[^ ]*)$
    Time_Key timestamp
    # Feb 02 03:30:11 2025
    Time_Format %b %d %T %Y
    Time_Keep On

[PARSER]
    Name qbd_console
    Format regex
    Regex /^[^|]+\| (?<timestamp>\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{2}:\d{2},\d{3}) (?<level>[^ ]+)  (?<message>[^\r\n]*)\r?\n(?:(?<extended_message>.+)\r?\n)?$/m
    Time_Key timestamp
    Time_Format  %Y-%m-%d %H:%M:%S,%L
    Time_Keep On

[PARSER]
    Name qbd_tomcat
    Format regex
    Regex /^(?<timestamp>\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{2}:\d{2},\d{3}) \[(?<thread>[^ ]+)\] (?<level>[^ ]+) (?<loggerName>[^ ]+) - (?<message>[^\r\n]*)\r?\n(?:(?<extended_message>.+)\r?\n)?$/m
    Time_Key timestamp
    Time_Format  %Y-%m-%d %H:%M:%S,%L
    Time_Keep On

[PARSER]
    Name sal_commons_daemon
    Format regex
    Regex ^\[(?<timestamp>[^\]]+)\] \[(?<level>[^\]]+)\]  \[(?<operationId>[^\]]+)\] (?<message>.*)$
    Time_Key timestamp
    Time_Format  %Y-%m-%d %H:%M:%S
    Time_Keep On

[PARSER]
    Name sca_server
    Format regex
    Regex ^(?<level>[^ ]+) +(?<timestamp>\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{2}:\d{2},\d{3}) - (?<message>.*)$
    Time_Key timestamp
    Time_Format  %Y-%m-%d %H:%M:%S,%L
    Time_Keep On

[PARSER]
    Name squid_access
    Format regex
    Regex ^(?<timestamp>\d+\.\d{3}) +(?<message>.+)$
    Time_Key timestamp
    Time_Format  %s.%L
    Time_Keep On

[PARSER]
    Name tomcat_builtin
    Format regex
    Regex /^(?<timestamp>\d{1,2}-\w{3}-\d{4} \d{1,2}:\d{2}:\d{2}\.\d{3}) (?<level>\w+) \[(?<thread>[a-zA-Z0-9$._\-\[\]]+)\] (?<loggerName>[a-zA-Z0-9$._-]+) (?<message>[^\r\n]*)\r?\n(?:(?<extended_message>.+)\r?\n)?$/m
    Time_Key timestamp
    Time_Format %d-%b-%Y %H:%M:%S.%L
    Time_Keep On

[PARSER]
    Name tomcat_access
    Format regex
    Regex ^(?<ipAddress>[0-9a-fA-F.:]+) - (?<remoteUser>[^\s]+) \[(?<timestamp>[^\]]+)\] "(?<requestFirstLine>[^"]+)" (?<httpStatus>\d{3}) (?<bytesSent>-|\d+)$
    Time_Key timestamp
    Time_Format %d/%b/%Y:%H:%M:%S %z
    Time_Keep On

[PARSER]
    Name tomcat_dus_entry
    Format regex
    Regex /^(?<timestamp>\d{4}-\d{1,2}-\d{1,2}T\d{1,2}:\d{2}:\d{2},\d{1,3})  (?<level>\w+) +(?<loggerName>[a-zA-Z0-9$._-]+) (?<runId>[0-9]+)? - (?<message>[^\r\n]*)\r?\n(?:(?<extended_message>.+)\r?\n)?$/m
    Time_Key timestamp
    Time_Format %Y-%m-%dT%H:%M:%S,%L
    Time_Keep On

[PARSER]
    Name tomcat_ep_access
    Format regex
    Regex ^(?<timestamp>\d{4}-\d{1,2}-\d{1,2}T\d{1,2}:\d{2}:\d{2},\d{1,3}) \[(?<userId>[a-zA-Z0-9_-]{3,255})? (?<sessionId>[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})?\] - (?<ipAddress>[0-9a-fA-F.:]+) (?<httpVerb>\w+) (?<url>.+)$
    Time_Key timestamp
    Time_Format %Y-%m-%dT%H:%M:%S,%L
    Time_Keep On

[PARSER]
    Name tomcat_ep_entry
    Format regex
    Regex /^(?<timestamp>\d{4}-\d{1,2}-\d{1,2}T\d{1,2}:\d{2}:\d{2},\d{1,3}) (?<level>\w+) (?<loggerName>[a-zA-Z0-9$._-]+) \[(?<threadId>\d+)? (?<sessionId>[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})?\] - (?<message>[^\r\n]*)\r?\n(?:(?<extended_message>.+)\r?\n)?$/m
    Time_Key timestamp
    Time_Format %Y-%m-%dT%H:%M:%S,%L
    Time_Keep On

[MULTILINE_PARSER]
    Name multiline_p4s_app
    Type regex
    Flush_Timeout 1000
    rule "start_state" "Perforce server info:" "cont"
    # Anything that is not a start state is a continuation
    rule "cont" "^(?!Perforce server info:)" "cont"

[MULTILINE_PARSER]
    Name multiline_hsw_text
    Type regex
    Flush_Timeout 1000
    rule "start_state" "^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}[+-]\d{2}:\d{2} .*$" "cont"
    # Anything that is not a start state is a continuation
    rule "cont" "^(?!^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}[+-]\d{2}:\d{2})" "cont"

[MULTILINE_PARSER]
    Name multiline_keycloak_server
    Type regex
    Flush_Timeout 1000
    rule "start_state" "^\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{2}:\d{2},\d{3} .*$" "cont"
    # Anything that is not a start state is a continuation
    rule "cont" "^(?!^\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{2}:\d{2},\d{3})" "cont"

[MULTILINE_PARSER]
    Name multiline_qbd_console
    Type regex
    Flush_Timeout 1000
    rule "start_state" "^[^|]+\| (?:\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{2}:\d{2},\d{3}) .*$" "cont"
    # Anything that is not a start state is a continuation
    rule "cont" "^[^|]+\| (?!\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{2}:\d{2},\d{3}) .*$" "cont"

[MULTILINE_PARSER]
    Name multiline_qbd_tomcat
    Type regex
    Flush_Timeout 1000
    rule "start_state" "^\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{2}:\d{2},\d{3} .*$" "cont"
    # Anything that is not a start state is a continuation
    rule "cont" "^(?!^\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{2}:\d{2},\d{3})" "cont"

[MULTILINE_PARSER]
    Name multiline_tomcat_builtin
    Type regex
    Flush_Timeout 1000
    rule "start_state" "^(?:\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{2}:\d{2} [+-]?\d{4})|(?:\d{1,2}-\w{3}-\d{4} \d{1,2}:\d{2}:\d{2}\.\d{3}) .*$" "cont"
    # Anything that is not a start state is a continuation
    rule "cont" "^(?!(?:\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{2}:\d{2} [+-]?\d{4})|(?:\d{1,2}-\w{3}-\d{4} \d{1,2}:\d{2}:\d{2}\.\d{3}))" "cont"

[MULTILINE_PARSER]
    Name multiline_tomcat_ep_entry
    Type regex
    Flush_Timeout 1000
    rule "start_state" "^\d{4}-\d{1,2}-\d{1,2}T\d{1,2}:\d{2}:\d{2},\d{1,3} .*$" "cont"
    rule "cont" "^[^0-9].+$" "cont"