title: Sending logs from fluentd to splunk
body: <p>I am using log4j , so have different formats of logs. I am able to send most of the logs using the below multiline format from fluentd to splunk, but few of them behave differently(The logs with different date format).</p>
  <pre><code>&lt;source&gt;
    @type tail
    path /tmp/LOG_SPLUNK.*
    pos_file /tmp/my-splunk.pos
    path_key log_type
    read_from_head true
    tag &quot;splunk.#log.mylogs&quot;
    format multiline
    format_firstline /^\[/
    format1 /\[(?&lt;timestamp&gt;[^ ]* [^ ]*)\] (?&lt;level&gt;[^ ]*) (?&lt;message&gt;.*)/
    time_type string
    time_key timestamp
    time_format %Y-%m-%d %H:%M:%S,%N
    keep_time_key true
  &lt;/source&gt;
  </code></pre>
  <p>Below are logs formats:</p>
  <pre><code>[2022-04-13 06:27:08,340] INFO Loading plugin from: /my/path (org.apache.kafka.connect.runtime.isolation.DelegatingClassLoader)
  java.lang.NullPointerException
      at java.util.Properties$LineReader.readLine(Properties.java:434)
      at java.util.Properties.load0(Properties.java:353)
      at java.util.Properties.load(Properties.java:341)
      at org.apache.kafka.connect.runtime.isolation.DelegatingClassLoader.versionFor(DelegatingClassLoader.java:380)
      at org.apache.kafka.connect.runtime.isolation.DelegatingClassLoader.versionFor(DelegatingClassLoader.java:385)
      at org.apache.kafka.connect.runtime.isolation.DelegatingClassLoader.getPluginDesc(DelegatingClassLoader.java:355)
      at org.apache.kafka.connect.runtime.isolation.DelegatingClassLoader.scanPluginPath(DelegatingClassLoader.java:328)
      at org.apache.kafka.connect.runtime.isolation.DelegatingClassLoader.scanUrlsAndAddPlugins(DelegatingClassLoader.java:261)
      at org.apache.kafka.connect.runtime.isolation.DelegatingClassLoader.registerPlugin(DelegatingClassLoader.java:253)
      at org.apache.kafka.connect.runtime.isolation.DelegatingClassLoader.initPluginLoader(DelegatingClassLoader.java:222)
      at org.apache.kafka.connect.runtime.isolation.DelegatingClassLoader.initLoaders(DelegatingClassLoader.java:199)
      at org.apache.kafka.connect.runtime.isolation.Plugins.&lt;init&gt;(Plugins.java:60)
      at org.apache.kafka.connect.cli.ConnectDistributed.startConnect(ConnectDistributed.java:91)
      at org.apache.kafka.connect.cli.ConnectDistributed.main(ConnectDistributed.java:78)
  [2022-04-13 06:27:09,520] INFO Registered loader: PluginClassLoader{pluginLocation=file:/my/path/} (org.apache.kafka.connect.runtime.isolation.DelegatingClassLoader)
  Apr 13, 2022 6:27:17 AM org.glassfish.jersey.internal.inject.Providers checkProviderRuntime
  WARNING: A provider org.apache.kafka.connect.runtime.rest.resources.ConnectorsResource registered in SERVER runtime does not implement any provider interfaces applicable in the SERVER runtime. Due to constraint configuration problems the provider org.apache.kafka.connect.runtime.rest.resources.ConnectorsResource will be ignored.
  </code></pre>
  <p>I am able to send all the above formats to splunk, but some behave differently. Is there any format using which i will be able to handle all. If i got a pattern not match error i could have included a format, but I don't</p>