# parse_log

> For the complete documentation index, see [llms.txt](https://docs.redpanda.com/llms.txt). Component-specific: [cloud-data-platform-full.txt](https://docs.redpanda.com/cloud-data-platform-full.txt)

---
title: parse_log
latest-operator-version: v26.1.4
latest-console-tag: v3.7.3
latest-connect-version: 4.93.0
latest-redpanda-tag: v26.1.9
docname: connect/components/processors/parse_log
page-component-name: cloud-data-platform
page-version: master
page-component-version: master
page-component-title: Cloud
page-relative-src-path: connect/components/processors/parse_log.adoc
page-edit-url: https://github.com/redpanda-data/cloud-docs/edit/main/modules/develop/pages/connect/components/processors/parse_log.adoc
page-git-created-date: "2024-09-09"
page-git-modified-date: "2026-05-26"
---

<!-- Source: https://docs.redpanda.com/cloud-data-platform/develop/connect/components/processors/parse_log.md -->

**Available in:** Cloud, [Self-Managed](https://docs.redpanda.com/connect/components/processors/parse_log/%20%22View%20the%20Self-Managed%20version%20of%20this%20component%22)

Parses common log [Formats](#formats) into [structured data](#codecs).

#### Common

```yml
processors:
  label: ""
  parse_log:
    format: "" # No default (required)
```

#### Advanced

```yml
processors:
  label: ""
  parse_log:
    format: "" # No default (required)
    best_effort: true
    allow_rfc3339: true
    default_year: current
    default_timezone: UTC
```

## [](#fields)Fields

### [](#allow_rfc3339)`allow_rfc3339`

Also accept timestamps in rfc3339 format while parsing. Applicable to format `syslog_rfc3164`.

**Type**: `bool`

**Default**: `true`

### [](#best_effort)`best_effort`

Still returns partially parsed messages even if an error occurs.

**Type**: `bool`

**Default**: `true`

### [](#default_timezone)`default_timezone`

Sets the strategy to decide the timezone for rfc3164 timestamps. Applicable to format `syslog_rfc3164`. This value should follow the [time.LoadLocation](https://golang.org/pkg/time/#LoadLocation) format.

**Type**: `string`

**Default**: `UTC`

### [](#default_year)`default_year`

Sets the strategy used to set the year for rfc3164 timestamps. Applicable to format `syslog_rfc3164`. When set to `current` the current year will be set, when set to an integer that value will be used. Leave this field empty to not set a default year at all.

**Type**: `string`

**Default**: `current`

### [](#format)`format`

A common log [format](#formats) to parse.

**Type**: `string`

**Options**: `syslog_rfc5424`, `syslog_rfc3164`

## [](#codecs)Codecs

Currently the only supported structured data codec is `json`.

## [](#formats)Formats

### [](#syslog_rfc5424)`syslog_rfc5424`

Attempts to parse a log following the [Syslog RFC5424](https://tools.ietf.org/html/rfc5424) spec. The resulting structured document may contain any of the following fields:

-   `message` (string)

-   `timestamp` (string, RFC3339)

-   `facility` (int)

-   `severity` (int)

-   `priority` (int)

-   `version` (int)

-   `hostname` (string)

-   `procid` (string)

-   `appname` (string)

-   `msgid` (string)

-   `structureddata` (object)


### [](#syslog_rfc3164)`syslog_rfc3164`

Attempts to parse a log following the [Syslog rfc3164](https://tools.ietf.org/html/rfc3164) spec. The resulting structured document may contain any of the following fields:

-   `message` (string)

-   `timestamp` (string, RFC3339)

-   `facility` (int)

-   `severity` (int)

-   `priority` (int)

-   `hostname` (string)

-   `procid` (string)

-   `appname` (string)

-   `msgid` (string)