Q&A aws alb add filed

[lhh528634141]

Question

function call error for "parse_aws_alb_log" at (94:122): Log should be fully consumed: " "conf.test.com" "-\

how to deal with aws alb logs，add 3 fileds

https://docs.aws.amazon.com/zh_cn/elasticloadbalancing/latest/application/load-balancer-access-logs.html

Vector Config

No response

Vector Logs

No response

[pront]

Use strict_mode: false to allow trailing fields:

.alb = parse_aws_alb_log!(.message, strict_mode: false)

This parses the supported fields into .alb and preserves the original .message. The new trailing fields are ignored by the parser, so they remain available only in the raw message.

Try it in the VRL Playground

Tested locally with Vector 0.59.0: a representative ALB line with the three appended fields fails in default strict mode and succeeds with strict_mode: false.

Please don't hesitate to followup in this thread if you have further questions.