clicktail.conf

[Application Options]

; APIHost = http://changeuser:changepass@localhost:8123/

; Only send 1 / N log lines
; SampleRate = 1

; Number of concurrent connections to open to Honeycomb
; NumSenders = 10

; How frequently to flush batches
; BatchFrequencyMs = 10000

; Maximum number of messages to put in a batch
; BatchSize = 1000000

; Print debugging output
; Debug = false

; How frequently, in seconds, to print out summary info
; StatusInterval = 60

; Configure clicktail to ingest old data in order to backfill Honeycomb. Sets the correct values for --backoff, --tail.read_from, and --tail.stop
; Backfill = false

; When parsing a timestamp that has no time zone, assume it is in the same timezone as localhost instead of UTC (the default)
; Localtime = false

; When parsing a timestamp use this time zone instead of UTC (the default). Must be specified in TZ format as seen here: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
; Timezone =

; For the field listed, apply a one-way hash to the field content. May be specified multiple times
; ScrubFields =

; Do not send the field to Honeycomb. May be specified multiple times
; DropFields =

; Add the field to every event. Field should be key=val. May be specified multiple times
; AddFields =

; Identify a field that contains an HTTP request of the form 'METHOD /path HTTP/1.x' or just the request path. Break apart that field into subfields that contain components. May be specified multiple times. Defaults to 'request' when using the nginx parser
; RequestShape =

; Prefix to use on fields generated from request_shape to prevent field collision
; ShapePrefix =

; A pattern for the request path on which to base the derived request_shape. May be specified multiple times. Patterns are considered in order; first match wins.
; RequestPattern =

; How to parse the request query parameters. 'whitelist' means only extract listed query keys. 'all' means to extract all query parameters as individual columns
; RequestParseQuery = whitelist

; Request query parameter key names to extract, when request_parse_query is 'whitelist'. May be specified multiple times.
; RequestQueryKeys =

; When rate limited by the API, back off and retry sending failed events. Otherwise failed events are dropped. When --backfill is set, it will override this option=true
; BackOff = false

; pass a regex to this flag to strip the matching prefix from the line before handing to the parser. Useful when log aggregation prepends a line header. Use named groups to extract fields into the event.
; PrefixRegex =

; enable dynamic sampling using the field listed in this option. May be specified multiple times; fields will be concatenated to form the dynsample key. WARNING increases CPU utilization dramatically over normal sampling
; DynSample =

; measurement window size for the dynsampler, in seconds
; DynWindowSec = 30

; if the rate of traffic falls below this, dynsampler won't sample
; MinSampleRate = 1

[Required Options]
; Parser module to use. Use --list to list available options.
; ParserName =

; Log file(s) to parse. Use '-' for STDIN, use this flag multiple times to tail multiple files, or use a glob (/path/to/foo-*.log)
; LogFiles =

; Name of the dataset
; Dataset =

[Other Modes]
; Show this help message
; Help = false

; List available parsers
; ListParsers = false

; Show version
; Version = false

[Tail Options]
; Location in the file from which to start reading. Values: beginning, end, last. Last picks up where it left off, if the file has not been rotated, otherwise beginning. When --backfill is set, it will override this option=beginning
; ReadFrom = last

; Stop reading the file after reaching the end rather than continuing to tail. When --backfill is set, it will override this option=true
; Stop = false

; use poll instead of inotify to tail files
; Poll = false

; File in which to store the last read position. Defaults to a file in /tmp named $logfile.leash.state. If tailing multiple files, default is forced.
; StateFile =

[JSON Parser Options]
; Name of the field that contains a timestamp
; TimeFieldName =

; Format of the timestamp found in timefield (supports strftime and Golang time formats)
; TimeFieldFormat =

[KeyVal Parser Options]
; Name of the field that contains a timestamp
; TimeFieldName =

; Format of the timestamp found in timefield (supports strftime and Golang time formats)
; TimeFieldFormat =

; a regular expression that will filter the input stream and only parse lines that match
; FilterRegex =

; change the filter_regex to only process lines that do *not* match
; InvertFilter = false

[MongoDB Parser Options]
; Send what was successfully parsed from a line (only if the error occured in the log line's message).
; LogPartials = false

[MySQL Parser Options]
; MySQL host in the format (address:port)
; Host =

; MySQL username
; User =

; MySQL password
; Pass =

; interval for querying the MySQL DB in seconds
; QueryInterval = 30

[Nginx Parser Options]
; Path to Nginx config file
; ConfigFile =

; Log format name to look for in the Nginx config file
; LogFormatName =

; Name of the field that contains a timestamp
; TimeFieldName =

; Timestamp format to use (strftime and Golang time.Parse supported)
; TimeFieldFormat =

[PostgreSQL Parser Options]
; Format string for PostgreSQL log line prefix
; LogLinePrefix =

[Regex Parser Options]
; Regular expression with named capture groups representing the fields you want parsed (RE2 syntax). You can enter multiple regexes to match (--regex.line_regex="(?P<foo>re)" --regex.line_regex="(?P<bar>...)"). Parses using the first regex to match a line, so list them in most-to-least-specific order.
; LineRegex =

; Name of the field that contains a timestamp
; TimeFieldName =

; Timestamp format to use (strftime and Golang time.Parse supported)
; TimeFieldFormat =