I can't forward the json format.

[kim-namjin]

I received zeek log(tsv format) as tail,
and Forward this to the zeek aggregator.

At this time, I want the output format to be json.

But the data received by aggregator is tsv line, not json.

  <source>
    @type tail
    path /log/Malcolm/zeek-logs/live/spool/logger/notice.log
    pos_file /log/td-agent/zeek.notice.log.pos
    tag zeek.notice
    <parse>
     @type tsv
     #zeek_notice_key_ref.https://docs.zeek.org/en/master/frameworks/notice.html#overview
     keys ts,uid,id.orig_h,id.orig_p,id.resp_h,id.resp_p,fuid,file_mime_type,file_desc,proto,note,msg,sub,src,dst,p,n,peer_descr,actions email-dest,suppress_for,dropped remote_location.country_code,remote_location.region,remote_location.city,remote_location.latitude,remote_location.longitude
    </parse>
  </source>

  <match zeek.**>
    @type copy

    <store>
      @type stdout
    < format>
      @type json
    </format>
  </store>

  <store>
    @type forward

    send_timeout 30s
    connect_timeout 30s
    recover_wait 10s
    hard_timeout 60s
    heartbeat_type udp
    keepalive true
    keepalive_timeout 60s

    <server>
      name log_aggregator
      host security-log-aggregator-nlb-53981fe074e9924a.elb.ap-northeast-2.amazonaws.com
      port 4002
    </server>

    <format>
      @type json
    </format>
  </store>
</match>

This is the result received by the fluentd aggregator and output to stdout.

  {"message":"1668039488.843434\t-\t-\t-\t-\t-\t-\t-\t-\t-\tATTACK::Discovery\tDetected activity from host 10.0.3.71, total attempts 6 within timeframe 5.0 mins\t-\t-\t-\t-\t-\tmanager\tNotice::ACTION_LOG\t(empty)\t3600.000000\t-\t-\t-\t-\t-"}
  { "message":"1668039493.841452\t-\t-\t-\t-\t-\t-\t-\t-\t-\tATTACK::Discovery\tDetected activity from host 10.0.100.84, total attempts 23 within timeframe 5.0 mins\t-\t-\t-\t-\t-\tmanager\tNotice::ACTION_LOG\t(empty)\t3600.000000\t-\t-\t-\t-\t-"}
  {"message":"1668039513.602637\t-\t-\t-\t-\t-\t-\t-\t-\t-\tATTACK::Discovery\tDetected activity from host 10.0.4.60, total attempts 30 within timeframe 5.0 mins\t-\t-\t-\t-\t-\tmanager\tNotice::ACTION_LOG\t(empty)\t3600.000000\t-\t-\t-\t-\t-"}
  {"message":"1668039524.132813\t-\t-\t-\t-\t-\t-\t-\t-\t-\tATTACK::Discovery\tDetected activity from host 10.0.155.32, total attempts 6 within timeframe 5.0 mins\t-\t-\t-\t-\t-\tmanager\tNotice::ACTION_LOG\t(empty)\t3600.000000\t-\t-\t-\t-\t-"}
  {"message":"1668039530.681835\t-\t-\t-\t-\t-\t-\t-\t-\t-\tATTACK::Discovery\tDetected activity from host 10.0.155.6, total attempts 5 within timeframe 5.0 mins\t-\t-\t-\t-\t-\tmanager\tNotice::ACTION_LOG\t(empty)\t3600.000000\t-\t-\t-\t-\t-"}

Can I know why I used the tsv parser but it was not parsed?

[fujimotos]

What you're missing is that you need to set up the JSON formatter
in the aggregator, not the forwarder side.

So remove this part from the forwarder:

    <format>
      @type json
    </format>

and put it to the appropriate part in aggregator's config.

[kim-namjin]

Thank you
I Solved it.