Fluent-bit to work like GROK

[vijaynauti]

Logs structure:
2023-01-23 04:53:15.178 INFO 26 CoreleationID12312a --- [trap-executor-0] c.n.d.s.r.aws.ConfigClusterResolver : Resolving branching endpoints via configuration CRT

Hi Team. Above mentioned is my log structure, and i want to implement something like grok. I am using Fluent-bit for sending the logs.
I want to have seperate fields for logs like.,,,
1) Timestamp -> 2023-01-23 04:53:15.178
2) LEVEL -> INFO
3) CorID -> CoreleationID12312a
4) Logs -> [trap-executor-0] c.n.d.s.r.aws.ConfigClusterResolver : Resolving branching endpoints via configuration CRT,

Please help how can I achieve this with Fluent-bit. @PettitWesley

[patrick-stephens]

I'm not sure I follow, I think you just need a parser?
https://docs.fluentbit.io/manual/pipeline/parsers

A regex one would let you capture the various groups you want: https://docs.fluentbit.io/manual/pipeline/parsers/regular-expression
There are various ones provided in the Fluent Bit distribution already and you can add your own custom ones too.

[PettitWesley]

Is "grok" not just a word but also a command??