<p>Currently we have the following config for syslog tdagent(fluentd) config and would like to create another field for priority:Error for my log.
How can I do this?</p>

<p>Log:</p>

<pre><code>Nov 11 00:18:57 Build01v nagios: SERVICE ALERT: mmj21;Dropwizard MMJ Thread Pool;UNKNOWN;SOFT;1;**Error**: unable to access dropwizard metrics at localhost using port 8001
</code></pre>

<p>Current config:</p>

<pre><code>&lt;source&gt;
  @type tail
    path           /var/log/messages
    pos_file       /var/log/td-agent/var_log_messages.pos
    read_from_head true
    tag            /var/log/messages
    &lt;parse&gt;
      @type regexp
        expression  ^(?&lt;time&gt;[^ ]* [^ ]* [^ ]*) (?&lt;host&gt;[^ ]*) (?&lt;process&gt;[^ ]*): (?&lt;message&gt;.*)$
        time_format %b %d %H:%M:%S
        time_key    time
    &lt;/parse&gt;
&lt;/source&gt;
</code></pre>

<p>Output:</p>

<pre><code>https://fluentular.herokuapp.com/parse?regexp=%5E%28%3F%3Ctime%3E%5B%5E+%5D*+%5B%5E+%5D*+%5B%5E+%5D*%29+%28%3F%3Chost%3E%5B%5E+%5D*%29+%28%3F%3Cprocess%3E%5B%5E+%5D*%29%3A+%28%3F%3Cmessage%3E.*%29%24&amp;input=Nov+11+00%3A18%3A57+Build01v+nagios%3A+SERVICE+ALERT%3A+mmj21%3BDropwizard+MMJ+Thread+Pool%3BUNKNOWN%3BSOFT%3B1%3B**Error%3A**+unable+to+access+dropwizard+metrics+at+localhost+using+port+8001&amp;time_format=%25b+%25d+%25H%3A%25M%3A%25S
</code></pre>

<p>Records</p>

<pre><code>Key     Value
host    Build01v
process nagios
message SERVICE ALERT: mmj21;Dropwizard MMJ Thread Pool;UNKNOWN;SOFT;1;**Error:** unable to access dropwizard metrics at localhost using port 8001
</code></pre>

<p>I'm guessing that maybe,</p>
<pre><code>^(?&lt;time&gt;\S* \S* \S*) (?&lt;host&gt;\S*) (?&lt;process&gt;[^:]*): (?&lt;priority&gt;[^:]*):(?&lt;message&gt;.*)$
</code></pre>
<p>might be what you're trying to write.</p>
<h3><a href="https://regex101.com/r/CfzuNe/1/" rel="nofollow noreferrer">RegEx Demo 1</a></h3>
<hr />
<p>If you wish to simplify/modify/explore the expression, it's been explained on the top right panel of <a href="https://regex101.com/r/WJnlt2/1/" rel="nofollow noreferrer">regex101.com</a>. If you'd like, you can also watch in <a href="https://regex101.com/r/WJnlt2/1/debugger" rel="nofollow noreferrer">this link</a>, how it would match against some sample inputs.</p>
<hr />
<h3>RegEx Circuit</h3>
<p><a href="https://jex.im/regulex/#!flags=&amp;re=%5E(a%7Cb)*%3F%24" rel="nofollow noreferrer">jex.im</a> visualizes regular expressions:</p>
<p><a href="https://i.stack.imgur.com/XFg8m.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/XFg8m.png" alt="enter image description here" /></a></p>
