openshift-fluentd-syslog-tail.conf

<source>
  @type tail
  path "#{ENV['DATA_DIR']}/messages*"
  pos_file "#{ENV['DATA_DIR']}/system.pos"
  tag system.*
  format multiline
  # Begin possible multiline match: "Mmm DD HH:MM:SS "
  format_firstline /^[A-Z][a-z]{2}\s+[0-3]?[0-9]\s+[0-2][0-9]:[0-5][0-9]:[0-6][0-9]\s/
  # extract metadata from same line that matched format_firstline
  format1 /^(?<time>\S+\s+\S+\s+\S+)\s+(?<host>\S+)\s+(?<ident>[\w\/\.\-]*)(?:\[(?<pid>[0-9]+)\])?[^\:]*\:\s*(?<message>.*)$/
  time_format %b %d %H:%M:%S
  read_from_head true
  keep_time_key true
  multiline_flush_interval 1s
</source>