title: How to create Regex pattern for fluentd
body: <p>I am trying to parse <code>daemon logs</code> from my linux machine to <code>elastic search</code> using <code>fluentd</code> but having hard time creating <code>regex</code> pattern for it. Below are few of the logs from the daemon logs:</p>
  
  <pre><code>Jun  5 06:46:14 user avahi-daemon[309]: Registering new address record for fe80::a7c0:8b54:ee45:ea4 on wlan0.*.
  Jun  5 06:46:14 user dhcpcd[337]: wlan0: deleting default route via fe80::1e56:feff:fe13:2da
  Jun  5 06:46:14 user dhcpcd[337]: wlan0: deleting route to 2402:3a80:9db:48da::/64
  Jun  5 06:46:14 user dhcpcd[337]: wlan0: deleting address fe80::a7c0:8b54:ee45:ea4
  Jun  5 06:46:14 user avahi-daemon[309]: Withdrawing address record for fe80::a7c0:8b54:ee45:ea4 on wlan0.
  Jun  5 06:46:14 user avahi-daemon[309]: Leaving mDNS multicast group on interface wlan0.IPv6 with address fe80::a7c0:8b54:ee45:ea4.
  </code></pre>
  
  <p>So as you can see from the above logs, first we have the <code>time</code> of the logs, then we have the <code>username</code> and the <code>daemon name</code>, followed by the <code>message</code>.</p>
  
  <p>I want to create below json format for the above logs:</p>
  
  <pre><code>{
      "time": "Jun  5 06:46:14",
      "username": "user",
      "daemon": "avahi-daemon[309]",
      "msg": "Registering new address record for fe80::a7c0:8b54:ee45:ea4 on wlan0.*."
  }
  
  {
      "time": "Jun  5 06:46:14",
      "username": "user",
      "daemon": "dhcpcd[337]: wlan0",
      "msg": "deleting default route via fe80::1e56:feff:fe13:2da"
  }
  </code></pre>
  
  <p>Can anyone please give me some help on this. Is there any tool which we can use to generate regex in fluentd.</p>
  
  <p>Edit:</p>
  
  <p>I have managed to get few things matched from the logs like:</p>
  
  <pre><code>^(?&lt;time&gt;^(.*?:.*?):\d\d) (?&lt;username&gt;[^ ]*) matches Jun  5 06:46:14 user
  </code></pre>
  
  <p>but when I am passing this in <a href="http://fluentular.herokuapp.com/parse?regexp=%5E%28%3F%3Ctime%3E.*%3F%3A.*%3F%29%3A%24&amp;input=Jun+we%3Art%3Ahn+raspberrypi&amp;time_format=" rel="nofollow noreferrer">fluentular</a>, its not showing any results.</p>