From e509d3bad61677a5ca474ed7b18d53dc82f5c4dc Mon Sep 17 00:00:00 2001
From: Bob Belnap <robert.belnap@uga.edu>
Date: Fri, 20 Mar 2020 10:44:38 -0400
Subject: [PATCH] defer the parsing of httpd messages until after the message
 is stored (this allows the whole message to appear in graylog, as well as
 being parsed)

---
 td-agent.conf | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/td-agent.conf b/td-agent.conf
index 2c12ef1..5f24245 100644
--- a/td-agent.conf
+++ b/td-agent.conf
@@ -15,10 +15,20 @@
   pos_file /var/log/td-agent/access_log.pos
   tag httpd.access
   <parse>
-    @type apache2
+    @type none
   </parse>
 </source>
 
+<filter httpd.access>
+  @type parser
+  key_name message
+  reserve_data true
+  <parse>
+    @type apache2
+  </parse>
+</filter>
+
+
 <match devel.*>
   @type copy
   <store>