Syslog input processing both rfc5424 and rfc3164?

[sandnabba]

Hello!

I'm trying to replace an old rsyslog -> promtail -> loki setup with just a lightweight fluent-bit.

However, I don't really get how to get an input to process multiple input formats (or if that's even possible?).

I found this on Stackoverflow about how to setup multiple [Filters] using different Parsers:
https://stackoverflow.com/questions/64269725/can-fluent-bit-parse-multiple-types-of-log-lines-from-one-file

But the problem with the syslog input is that it requires a Parser to be set already on the input. So If I send an rfc3164 message, it get dropped with a [input:syslog:syslog.0] error parsing log message with parser 'syslog-rfc5424' message.

I've understood that an input only can have one parser, so is there some workaround setting up the parser to process multiple formats? (Or setting up multiple inputs in some way?)

[patrick-stephens]

You can use a parser filter after the input. That can take multiple parsers or you can chain multiple filters. If a parser does not apply then the data is left unchanged.