add parsing of traefik logs

Author: bisgaard-itis

services/logging/vector.yaml

@@ -27,6 +27,7 @@ transforms:
 
       # Extract structured log fields from message using regex pattern
       if exists(.message) {
+        # python service logs
         parsed_fields, err = parse_regex(.message, r'log_level=(?P<log_level>[^|]*) \| log_timestamp=(?P<log_timestamp>[^|]*) \| log_source=(?P<log_source>[^|]*) \| log_uid=(?P<log_uid>[^|]*) \| log_oec=(?P<log_oec>[^|]*) \| log_trace_id=(?P<log_trace_id>[^|]*) \| log_span_id=(?P<log_span_id>[^|]*) \| log_msg=(?P<log_msg>.*)$')
         if err == null {
           .log_level = parsed_fields.log_level
@@ -38,6 +39,13 @@ transforms:
           .log_span_id = parsed_fields.log_span_id
           .log_msg = parsed_fields.log_msg
         }
+        # traefik logs
+        traefik_fields, traefik_err = parse_regex(.message, r'time="(?P<log_timestamp>[^"]*)" level=(?P<log_level>\w+) msg="(?P<log_msg>.*)"')
+        if traefik_err == null {
+          .log_timestamp = traefik_fields.log_timestamp
+          .log_level = traefik_fields.log_level
+          .log_msg = traefik_fields.log_msg
+        }
       }
 
       # Handle container name - GELF uses _container_name (with underscore prefix)