filelog/{{ name|default('messages') }}: include: - {{ filename|default('/var/log/messages') }} include_file_path: true operators: - type: regex_parser regex: '^(?P\w{3}\s\d{2}\s\d{2}:\d{2}:\d{2})\s(?P[\w_-]+)\s(?P[\w_-]+)(\[(?P\d+)\])?:\s(?P.*)$' timestamp: parse_from: attributes["ts"] layout: '%b %d %H:%M:%S' - type: move from: attributes["pid"] to: attributes["process.pid"] - type: move from: attributes["process"] to: resource["service.name"] - type: move from: attributes["body"] to: body # Add a service version, the template version - type: add field: resource["service.version"] value: '1.0.0' # Remove the hostname, use the resource detectors - type: remove field: attributes["hostname"] - type: remove field: attributes["ts"]