Can Log receiver handle multiple format at the same time?

[owensulei3841]

Hi All,

I'm using file log receiver to extract log, and want to ask if it can handle multiple formats at the same time.

We have team using "tab delimiter" and some using "space delimiter" for access log.

This work when they using "space delimiter"

      operators:
        - type: regex_parser
          regex: '^(?P<time>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z) (?P<msg>.*)$'
          timestamp:
            parse_from: attributes.time
            layout: '%Y-%m-%dT%H:%M:%S.%fZ'
        - type: key_value_parser
          parse_from: attributes.msg

This work when they using "tab delimiter"

        - type: regex_parser
          regex: '^(?P<time>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z)\t(?P<msg>.*)$'
          timestamp:
            parse_from: attributes.time
            layout: '%Y-%m-%dT%H:%M:%S.%fZ'
        - type: key_value_parser
          parse_from: attributes.msg
          pair_delimiter: "\t"
          

Is there a way we can configure the file log receiver to accept both format?
Can we have some logic like if it doesn't match "space delimiter" format, it will go to "tab delimiter" format pipeline? Vice versa
cc @ItsLastDay Thank you very much