[Q&A] How to Get Values from Syslog RFC5424 Headers

[lisazhao30]

How can I read the values set in the headers from Syslog RFC 5424 messages inside Fluent Bit? For example, if I want to add the appName and procId headers to the tag of the log.

Sample code with rewrite_tag that doesn't work as the variables do not exist.

    [INPUT]
      Name              syslog
      Mode              tcp
      Listen            0.0.0.0
      Parser            syslog-rfc5424
      Port              6514
      Tag               syslog-raw
    
    [FILTER]
      Name                rewrite_tag
      Match               syslog-raw
      Rule                $level ^(ERROR|FATAL|WARN)$ ${appname}.${procid} false

[patrick-stephens]

Add a stdout output or filter to show you what the parser is actually providing?