One important fact. We are extracting fields using following "special" hack
[(?::){0}k8s*]
EXTRACT-uno_fields = ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{3}Z\s+(?P<severity>\w+)\s+(?P<logger>[^\s]+)\s+(?:(?P<th
readId>[^\s]+)?\s+)?\[(?P<thread>[^\]]+)\]\s+-\s+(?P<message>.*)
REPORT-uno_thread_fields = uno_thread_fields
EVAL-severity = if(isnotnull(severity), severity, "n/a")
EVAL-traceId = if(isnotnull(traceId), traceId, "n/a")
EVAL-parentId = if(isnotnull(parentId), parentId, "n/a")
EVAL-spanId = if(isnotnull(spanId), spanId, "n/a")
EVAL-logger = if(isnotnull(logger), logger, "n/a")
# temporarily for backward compatibility
FIELDALIAS-uno_logLevel = severity as uno_logLevel
FIELDALIAS-uno_logger = logger as uno_logger
FIELDALIAS-uno_thread = thread as uno_thread
FIELDALIAS-uno_message = message as uno_message
FIELDALIAS-uno_time = _time as uno_time
... View more