Convert unstructured messages to structured messages
Dealing with raw strings or unstructured messages is difficult. Having a structure makes data more usable. Set a structure to the incoming data by using input plugins as data is collected:
The parser converts unstructured data to structured data. As an example, consider the following Apache (HTTP Server) log entry:
This log line is a raw string without format. Structuring the log makes it easier to process the data later. If the regular expression parser is used, the log entry could be converted to:
Parsers are fully configurable and are independently and optionally handled by each input plugin. For more details, see Parsers.