templates/td-agent.conf

@@ -21,7 +21,7 @@
   <parse>
     @type multi_format
     <pattern>
-      format /^(?<prefix>.+) (?<ps>\w+)\[(?<pid>\d+)\]: (?<c_ip>[\w\.]+):(?<c_port>\d+) \[(?<syslog_time>.+)\] (?<f_end>[\w\.\-~]+) (?<b_end>[\w\.\-]+)\/(?<b_server>[\<\>\w\.\-]+) (?<tq>\d+)\/(?<tw>\d+)\/(?<tc>\d+)\/(?<tr>\d+)\/(?<tt>\d+) (?<status_code>\d+) (?<bytes_read>\d+) (?<captured_request_cookie>.+) (?<captured_response_cookie>.+) (?<termination_state>.+) (?<actconn>\d+)\/(?<feconn>\d+)\/(?<beconn>\d+)\/(?<srv_conn>\d+)\/(?<retries>\d+) (?<srv_queue>\d+)\/(?<backend_queue>\d+) (?<sni>[\w\.\-~]+) "(?<http_request>.+)"$/
+      format /^(?<prefix>.+) (?<ps>\w+)\[(?<pid>\d+)\]: (?<c_ip>[\w\.]+):(?<c_port>\d+) \[(?<syslog_time>.+)\] (?<f_end>[\w\.\-~]+) (?<b_end>[\w\.\-]+)\/(?<b_server>[\<\>\w\.\-]+) (?<tq>\d+)\/(?<tw>\d+)\/(?<tc>\d+)\/(?<tr>\d+)\/(?<tt>\d+) (?<status_code>\d+) (?<bytes_read>\d+) (?<captured_request_cookie>.+) (?<captured_response_cookie>.+) (?<termination_state>.+) (?<actconn>\d+)\/(?<feconn>\d+)\/(?<beconn>\d+)\/(?<srv_conn>\d+)\/(?<retries>\d+) (?<srv_queue>\d+)\/(?<backend_queue>\d+) (?<sni>[\w\.\-~]+) {(?<user_agent>.+)} "(?<http_request>.+)"$/
     </pattern>
     <pattern>
       format /^(?<prefix>.+) (?<ps>\w+)\[(?<pid>\d+)\]: (?<message>.+)$/