fluent.conf

<source>
  @type pipe
  path /log/php-error.log
  multiline_flush_interval 2s
  emit_unmatched_lines true
  format multiline
  format_firstline /^\[\d{2}-\w{3}-\d{4}\s+\d{2}:\d{2}:\d{2}\s\w+\/\w+\]/
  format1 /^\[(?<time>\d{2}-\w{3}-\d{4}\s+\d{2}:\d{2}:\d{2}\s\w+\/\w+)\] PHP (?<severity>[^:]+):\s?+(?<msg>.*)/
  time_format %d-%b-%Y %H:%M:%S %Z
  tag php.error
</source>

<source>
  @type pipe
  path /log/fpm-error.log
  multiline_flush_interval 2s
  emit_unmatched_lines true
  format multiline
  format_firstline /^\[\d{2}-\w{3}-\d{4}\s+\d{2}:\d{2}:\d{2}(.?\d+)?\]/
  format1 /^\[(?<timestamp>\d{2}-\w{3}-\d{4}\s+\d{2}:\d{2}:\d{2}(.?\d+)?\]) (?<msg>.*)/
  time_format %d-%b-%Y %H:%M:%S
  tag php.fpm-error
</source>

<source>
  @type pipe
  path /log/slow.log
  multiline_flush_interval 2s
  emit_unmatched_lines true
  format multiline
  format_firstline /^\[\d{2}-\w{3}-\d{4}\s+\d{2}:\d{2}:\d{2}\]/
  format1 /^\[(?<time>\d{2}-\w{3}-\d{4}\s+\d{2}:\d{2}:\d{2})\]\s+\[pool\s+(?<pool>\w+)\]\s+pid\s+(?<pid>\d+)\s?(?<msg>.*)/
  time_format %d-%b-%Y %H:%M:%S
  tag php.slowlog
</source>

<source>
  @type pipe
  path /log/app-error.json
  format none
  tag php.app-errors
</source>

<source>
  @type pipe
  path /log/app-access.json
  format none
  tag php.app-access
</source>

<filter php.error>
  @type map
  time time
  # TODO install ruby to use `record["msg"].strip` & `record["severity"].upcase`.
  record ({"php_error_log" => {"error" => record["msg"], "level" => record["severity"]}})
</filter>

<filter php.app-*>
  @type parser
  format json
  key_name message
</filter>

<filter php.*>
  @type record_transformer
  <record>
    hostname "#{Socket.gethostname}"
    event_type ${tag}
    team "#{ENV['TEAM']}"
    application "#{ENV['APPLICATION']}"
  </record>
</filter>

# this must be the latest filter
<filter php.*>
  @type stdout
  include_time_key true
  format json
</filter>

<match **>
  @type null
</match>