How to exclude event id (?) and whatever this number is?

[pieroway]

[3] tail.0: [1652132310.061932300, {"log"=>"{"level" : "DEBUG",         "timestamp" : "2022-05-09:05:38:29",        "service" :  "ReportingService",        "details" : {
    "thread_id" :  "10",               "Aspnet_details" : {                             "aspnet-session" :  "NOT AVAILABLE",               "request_url" :  "NOT AVAILABLE ",
        "remote_addr" :  "NOT AVAILABLE ",               "user_agent" :  "NOT AVAILABLE ",                         "request_method" :  "NOT AVAILABLE ",               "Server_name"
 :  "NOT AVAILABLE ",               "Server_port" :  "NOT AVAILABLE ",               "Instance_id" :  "NOT AVAILABLE ",               "SERVER_PROTOCOL" :  "NOT AVAILABLE "
      } },                 "message" : [ "RS: Cycle complete. Sleeping." ],        "exception" : [ "" ]        }"}]

I need to exclude the leading [3] tail.0: [1652132310.061932300, {"log"=>" and trailing ] and just have the content of the input logs (the source logs being json) .

I cannot figure out how to do this as I am not even sure what they are called or used for. I've played with filters but to no effect. I can't remove what I can't identify.

I have looked at all the docs and googled this but haven't had much luck so far.

For now, my simple command line to run fluent-bit is:

"C:\Program Files\fluent-bit\bin\fluent-bit.exe" -o stdout -c "C:\Program Files\fluent-bit\conf\fluent-bit.conf

My fluent-bit.conf file is for testing purposes while I refine my fluent-bit.conf file (i've sanitized the company and product name):

[INPUT]
    Name  tail
    Path  C:\\Program Files\\MyCompany\MyProduct\\sasLog\\*.log

[OUTPUT]
    Name  stdout
    Match *

Any help or, better yet, pointers to the proper documentation to understand what needs doing would be appreciated. :)

[pieroway]

To answer my question, set the json_date_key to false on the [OUTPUT] for stdout.

[OUTPUT]
    Name stdout
    Match *
    json_date_key false