@@ -104,6 +104,17 @@ You can use this parser without `multiline_start_regexp` when you know your data
104104* ** grok_name_key** (string) (optional): The key name to store grok section's name
105105* ** multi_line_start_regexp** (string) (optional): The regexp to match beginning of multiline. This is only for "multiline_grok".
106106
107+ ### \< grok\> section (optional) (multiple)
108+
109+ * ** name** (string) (optional): The name of this grok section
110+ * ** pattern** (string) (required): The pattern of grok
111+ * ** keep_time_key** (bool) (optional): If true, keep time field in the record.
112+ * ** time_key** (string) (optional): Specify time field for event time. If the event doesn't have this field, current time is used.
113+ * Default value: ` time ` .
114+ * ** time_format** (string) (optional): Process value using specified format. This is available only when time_type is string
115+ * ** timezone** (string) (optional): Use specified timezone. one can parse/format the time value in the specified timezone.
116+
117+
107118## Examples
108119
109120### Using grok\_ failure\_ key
@@ -183,6 +194,28 @@ This will add keys like following:
183194Add ` grokfailure ` key to the record if the record does not match any grok pattern.
184195See also test code for more details.
185196
197+ ## How to parse time value using specific timezone
198+
199+ ``` aconf
200+ <source>
201+ @type tail
202+ path /path/to/log
203+ tag grokked_log
204+ <parse>
205+ @type grok
206+ <grok>
207+ name mylog-without-timezone
208+ pattern %{DATESTAMP:time} %{GREEDYDATE:message}
209+ timezone Asia/Tokyo
210+ </grok>
211+ </parse>
212+ </source>
213+ ```
214+
215+ This will parse the ` time ` value as "Asia/Tokyo" timezone.
216+
217+ See [ Config: Parse Section - Fluentd] ( https://docs.fluentd.org/configuration/parse-section ) for more details about timezone.
218+
186219## How to write Grok patterns
187220
188221Grok patterns look like ` %{PATTERN_NAME:name} ` where ": name " is optional. If "name" is provided, then it
0 commit comments