@type parser reserve_data true format grok key_name Payload grok_pattern %{TIMESTAMP_ISO8601:Timestamp} %{NUMBER:Pid} %{LOGLEVEL:log_level} %{NOTSPACE:python_module} \[(?:req-(?:%{NOTSPACE:request_id}) (?:%{NOTSPACE:user_id}) (?:%{NOTSPACE:tenant_id}) (?:%{NOTSPACE:domain_id}) (?:%{NOTSPACE:user_domain}) (?:%{NOTSPACE:project_domain})|-)\] %{GREEDYDATA:Payload} time_format "%Y-%m-%d %H:%M:%S.%L" time_key Timestamp keep_time_key true