Question: Regex transformation of message possible? about seq-input-gelf HOT 3 CLOSED

Hi @Ergamon 👋

We actually don't have a nice way to do this currently. Seq's CLI has this concept of extraction patterns that would be a good fit for this. We don't have a Rust implementation of them yet but I think this sounds like a great addition.

from seq-input-gelf.

Thanks for your quick reply. At least I now know that I have not overlooked something ;)

Intitially I had thought about some regex replace mechanism, but what you showed is also fine.

As every container has its own "logging syntax" it cannot be something hard wired in the gelf server.

If I could wish for this new feature, my idea would be to have some label on the container for the extraction pattern.
So server side I would configure the name of the label for the pattern, which is then not send to the seq.
On the container side I would have to add the label and add the label to the logging options for gelf.

from seq-input-gelf.

Coming back to this, the way you could do this today would be through something like fluentbit, which lets you transform and reshape your logs between their producer and the eventual consumer. In the future we might consider some similar data pipelining functionality in Seq itself, but don't have any immediate plans for it.

This would be great to support, but having thought about it I think we should avoid accumulating these sorts of configurable transformations in the GELF input itself.

Thanks again for the suggestion @Ergamon!

from seq-input-gelf.