Parse a fixed width-encoded field into known columns. It can parse values of the form:

logscale
value 1 value 2 value 3, widths [8,8,8]
value 1value 2value 3, widths [7,7,7]

For a log line like this:

logscale
2017-02-22T13:14:01.917+0000 [main thread] INFO statsModule got result="117success 27% 3.14"

Using parseFixedWidth(result, columns=[count, status, completion, precision, sourcetask], widths=[3,9,4,10,10) will add these fields:

logscale
count: 117
status: success
completion: 27%
precision: 3.14

Sourcetask will not get assigned a value, as there were too few columns in the input for that. Values are trimmed after they have been extracted, i.e. success will become success from the above example.

Use the (unnamed) field parameter to specify which field should be parsed. Specify @rawstring to parse the raw string

ParameterTypeRequiredDefaultDescription
columnsArray of stringsrequired  Names of columns to extract from field.
field[a]stringoptional[b]@rawstring Field that holds the input in fixed width form.
trimbooleanoptional[b]true Remove leading and trailing white-space from fields after extracting.
widthsArray of numbersrequired  Widths of columns.

[a] The argument name field can be omitted.

[b] Optional parameters use their default value unless explicitly set

Omitted Argument Names

The argument name for field can be omitted; the following forms of this function are equivalent:

logscale
parseFixedWidth("@rawstring")

and:

logscale
parseFixedWidth(field="@rawstring")

Fixed width parse the result field from a log line:

accesslog
statsModule got result="117success 27% 3.14

This will add the following fields to the event:

  • count=117

  • status=success

  • completion=27%

  • precision=3.14

sourcetask will not get set as the input is too short.

logscale
parseFixedWidth(result, columns=[count, status, completion, precision, sourcetask], widths=[3,9,4,10,10])