Output

Azure Storage account name

Creates container if ContainerName is not set.

Specify the desired blob type. Must be `appendblob` or `blockblob`

Enable buffering into disk before ingesting into Azure Blob.

Optional: Enables GZIP compression in the final blockblob file. This option isn't compatible when blob_type = appendblob.

Name of the container that will contain the blobs

Optional toggle to use an Azure emulator

HTTP Service of the endpoint (if using EmulatorMode)

Optional path to store the blobs.

Specifies the size of files to be uploaded in MB. Defaults to 200M.

Optional. Specify a timeout for uploads. Fluent Bit will start ingesting buffer files which have been created more than x minutes ago and haven't reached upload_file_size limit yet. Defaults to 30m.

Name of the event type.

Set a record key that will populate 'logtype'. If the key is found, it will have precedence

If set, overrides the timeKey value with the `time-generated-field` HTTP header value.

Specify the name of the key where the timestamp is stored.

Automatically create the log group. Defaults to False.

Automatically retry failed requests to CloudWatch once. Defaults to True.

Custom endpoint for CloudWatch logs API

Specify an external ID for the STS API.

Optional parameter to tell CloudWatch the format of the data

Name of Cloudwatch Log Group to send log records to

Template for Log Group name, overrides LogGroupName if set.

If set, only the value of the key will be sent to CloudWatch

Number of days logs are retained for

The name of the CloudWatch Log Stream to send log records to

Prefix for the Log Stream name. Not compatible with LogStreamName setting

Template for Log Stream name. Overrides LogStreamPrefix and LogStreamName if set.

Optional lists of lists for dimension keys to be added to all metrics. Use comma separated strings for one list of dimensions and semicolon separated strings for list of lists dimensions.

Optional string to represent the CloudWatch namespace.

AWS Region

Role ARN to use for cross-account access

Specify a custom STS endpoint for the AWS STS API

Config holds any unsupported plugins classic configurations, if ConfigFileFormat is set to yaml, this filed will be ignored

YamlConfig holds the unsupported plugins yaml configurations, it only works when the ConfigFileFormat is yaml

Compress the payload in GZIP format. Datadog supports and recommends setting this to gzip.

By default, the plugin searches for the key 'log' and remap the value to the key 'message'. If the property is set, the plugin will search the property name key.

The human readable name for your service generating the logs.

A human readable name for the underlying technology of your service.

The tags you want to assign to your logs in Datadog.

Host is the Datadog server where you are sending your logs.

If enabled, a tag is appended to output. The key name is used tag_key property.

Date key name for output.

To activate the remapping, specify configuration flag provider.

Specify an HTTP Proxy.

The key name of tag. If include_tag_key is false, This property is ignored.

TLS controls whether to use end-to-end security communications security protocol. Datadog recommends setting this to on.

Enable AWS Sigv4 Authentication for Amazon ElasticSearch Service.

External ID for the AWS IAM Role specified with aws_role_arn.

Specify the AWS region for Amazon ElasticSearch Service.

AWS IAM Role to assume to put records to your Amazon ES cluster.

Specify the custom sts endpoint to be used with STS API for Amazon ElasticSearch Service.

Specify the buffer size used to read the response from the Elasticsearch HTTP service. This option is useful for debugging purposes where is required to read full responses, note that response size grows depending of the number of records inserted. To set an unlimited amount of memory set this value to False, otherwise the value must be according to the Unit Size specification.

Specify the credentials to use to connect to Elastic's Elasticsearch Service running on Elastic Cloud.

If you are using Elastic's Elasticsearch Service you can specify the cloud_id of the cluster running.

Set payload compression mechanism. Option available is 'gzip'

Use current time for index generation instead of message record

When enabled, generate _id for outgoing records. This prevents duplicate records when retrying ES.

IP address or hostname of the target Elasticsearch instance

If set, _id will be the value of the key from incoming record and Generate_ID option is ignored.

When enabled, it append the Tag name to the record.

Index name

Time format (based on strftime) to generate the second part of the Index name.

Enable Logstash format compatibility. This option takes a boolean value: True/False, On/Off

When Logstash_Format is enabled, the Index name is composed using a prefix and the date, e.g: If Logstash_Prefix is equals to 'mydata' your index will become 'mydata-YYYY.MM.DD'. The last string appended belongs to the date when the data is being generated.

Prefix keys with this string

Elasticsearch accepts new data on HTTP query path "/_bulk". But it is also possible to serve Elasticsearch behind a reverse proxy on a subpath. This option defines such path on the fluent-bit side. It simply adds a path prefix in the indexing HTTP POST URI.

Newer versions of Elasticsearch allows setting up filters called pipelines. This option allows defining which pipeline the database should use. For performance reasons is strongly suggested parsing and filtering on Fluent Bit side, avoid pipelines.

TCP port of the target Elasticsearch instance

When enabled, replace field name dots with underscore, required by Elasticsearch 2.0-2.3.

When enabled, mapping types is removed and Type option is ignored. Types are deprecated in APIs in v7.0. This options is for v7.0 or later.

When Include_Tag_Key is enabled, this property defines the key name for the tag.

When Logstash_Format is enabled, each record will get a new timestamp field. The Time_Key property defines the name of that field.

When Logstash_Format is enabled, this property defines the format of the timestamp.

When Logstash_Format is enabled, enabling this property sends nanosecond precision timestamps.

Limit the maximum number of Chunks in the filesystem for the current output logical destination.

When enabled print the elasticsearch API calls to stdout when elasticsearch returns an error

When enabled print the elasticsearch API calls to stdout (for diag only)

Type name

Operation to use to write in bulk requests.

The character to separate each pair. Applicable only if format is csv or ltsv.

Set file name to store the records. If not set, the file name will be the tag associated with the records.

The format of the file content. See also Format section. Default: out_file.

The character to separate each pair. Applicable only if format is ltsv.

Absolute directory path to store files. If not set, Fluent Bit will write the files on it's own positioned directory.

The format string. Applicable only if format is template.

Immediately retry failed requests to AWS services once. This option does not affect the normal Fluent Bit retry mechanism with backoff. Instead, it enables an immediate retry with no delay for networking errors, which may help improve throughput when there are transient/random networking issues.

Compression type to use when compressing the data. Valid values are: gzip, snappy, lz4, zstd. If you do not specify a compression type, the data will be sent uncompressed.

By default, the whole log record will be sent to Kinesis. If you specify a key name(s) with this option, then only those keys and values will be sent to Kinesis. For example, if you are using the Fluentd Docker log driver, you can specify data_keys log and only the log message will be sent to Kinesis. If you specify multiple keys, they should be comma delimited.

The name of the Kinesis Firehose Delivery stream that you want log records sent to.

Specify a custom endpoint for the Kinesis Firehose API.

Specify an external ID for the STS API, can be used with the role_arn parameter if your role requires an external ID.

By default, the whole log record will be sent to Firehose. If you specify a key name with this option, then only the value of that key will be sent to Firehose. For example, if you are using the Fluentd Docker log driver, you can specify log_key log and only the log message will be sent to Firehose.

Option to specify an AWS Profile for credentials.

The AWS region.

ARN of an IAM role to assume (for cross account access).

Option to enable simple aggregation for the Firehose output plugin.

Specify a custom endpoint for the STS API; used to assume your custom role provided with role_arn.

Add the timestamp to the record under this key. By default, the timestamp from Fluent Bit will not be added to records sent to Kinesis.

strftime compliant format string for the timestamp; for example, %Y-%m-%dT%H *string This option is used with time_key. You can also use %L for milliseconds and %f for microseconds. If you are using ECS FireLens, make sure you are running Amazon ECS Container Agent v1.42.0 or later, otherwise the timestamps associated with your container logs will only have second precision.

Specify number of worker threads to use to output to Firehose

Use this option to connect to Fluentd with a zero-length secret.

Target host where Fluent-Bit or Fluentd are listening for Forward messages.

TCP Port of the target service.

Send "chunk"-option and wait for "ack" response from server. Enables at-least-once and receiving server can control rate of traffic. (Requires Fluentd v0.14.0+ server)

Retain metadata when forwarding in forward mode.

Default value of the auto-generated certificate common name (CN).

Always send options (with "size"=count of messages)

A key string known by the remote Fluentd used for authorization.

Overwrite the tag as we transmit. This allows the receiving pipeline start fresh, or to attribute source.

Set timestamps in integer format, it enable compatibility mode for Fluentd v0.12 series.

If transport protocol is udp, it defines if UDP packets should be compressed.

FullMessageKey is the key to use as the long message that can i.e. contain a backtrace.

IP address or hostname of the target Graylog server.

HostKey is the key which its value is used as the name of the host, source or application that sent this message.

LevelKey is the key to be used as the log level.

The protocol to use (tls, tcp or udp).

If transport protocol is udp, it sets the size of packets to be sent.

The port that the target Graylog server is listening on.

ShortMessageKey is the key to use as the short message.

TimestampKey is the key which its value is used as the timestamp of the message.

Specify if duplicated headers are allowed. If a duplicated header is found, the latest key/value set is preserved.

Set payload compression mechanism. Option available is 'gzip'

Specify the data format to be used in the HTTP request body, by default it uses msgpack. Other supported formats are json, json_stream and json_lines and gelf.

Specify the key to use for the full message in gelf format

Specify the key to use for the host in gelf format

Specify the key to use for the level in gelf format

Specify the key to use as the short message in gelf format

Specify the key to use for timestamp in gelf format

Specify an optional HTTP header field for the original message tag.

Add a HTTP header key/value pair. Multiple headers can be set.

IP address or hostname of the target HTTP Server

Specify the format of the date. Supported formats are double, epoch and iso8601 (eg: 2018-05-30T09:39:52.000681Z)

Specify the name of the time key in the output record. To disable the time key just set the value to false.

Specify if the response paylod should be logged or not.

TCP port of the target HTTP Server

Specify an HTTP Proxy. The expected format of this value is http://host:port. Note that https is not supported yet.

Limit the maximum number of Chunks in the filesystem for the current output logical destination.

Specify an optional HTTP URI for the target web server, e.g: /something

Automatically tag keys where value is string.

InfluxDB bucket name where records will be inserted - if specified, database is ignored and v2 of API is used

InfluxDB database name where records will be inserted.

IP address or hostname of the target InfluxDB service.

InfluxDB organization name where the bucket is (v2 only)

TCP port of the target InfluxDB service.

The name of the tag whose value is incremented for the consecutive simultaneous events.

List of keys that needs to be tagged

Key of the string array optionally contained within each log record that contains tag keys for that record

Dynamically tag keys which are in the string array at Tags_List_Key key.

Single of multiple list of Kafka Brokers, e.g: 192.168.1.3:9092, 192.168.1.4:9092.

Adds unknown topics (found in Topic_Key) to Topics. So in Topics only a default topic needs to be configured

Specify data format, options available: json, msgpack.

Optional key to store the message

If set, the value of Message_Key_Field in the record will indicate the message key. If not set nor found in the record, Message_Key will be used (if set).

Fluent Bit queues data into rdkafka library, if for some reason the underlying library cannot flush the records the queue might fills up blocking new addition of records. The queue_full_retries option set the number of local retries to enqueue the data. The default value is 10 times, the interval between each retry is 1 second. Setting the queue_full_retries value to 0 set's an unlimited number of retries.

{property} can be any librdkafka properties

iso8601 or double

Set the key to store the record timestamp

If multiple Topics exists, the value of Topic_Key in the record will indicate the topic to use. E.g: if Topic_Key is router and the record is {"key1": 123, "router": "route_2"}, Fluent Bit will use topic route_2. Note that if the value of Topic_Key is not present in Topics, then by default the first topic in the Topics list will indicate the topic to be used.

Single entry or list of topics separated by comma (,) that Fluent Bit will use to send messages to Kafka. If only one topic is set, that one will be used for all records. Instead if multiple topics exists, the one set in the record by Topic_Key will be used.

Limit the maximum number of Chunks in the filesystem for the current output logical destination.

Enables dedicated thread(s) for this output. Default value is set since version 1.8.13. For previous versions is 0.

Immediately retry failed requests to AWS services once. This option does not affect the normal Fluent Bit retry mechanism with backoff. Instead, it enables an immediate retry with no delay for networking errors, which may help improve throughput when there are transient/random networking issues. This option defaults to true.

Specify a custom endpoint for the Kinesis API.

Specify an external ID for the STS API, can be used with the role_arn parameter if your role requires an external ID.

By default, the whole log record will be sent to Kinesis. If you specify a key name with this option, then only the value of that key will be sent to Kinesis. For example, if you are using the Fluentd Docker log driver, you can specify log_key log and only the log message will be sent to Kinesis.

The AWS region.

ARN of an IAM role to assume (for cross account access).

The name of the Kinesis Streams Delivery stream that you want log records sent to.

Custom endpoint for the STS API.

Add the timestamp to the record under this key. By default the timestamp from Fluent Bit will not be added to records sent to Kinesis.

strftime compliant format string for the timestamp; for example, the default is '%Y-%m-%dT%H:%M:%S'. Supports millisecond precision with '%3N' and supports nanosecond precision with '%9N' and '%L'; for example, adding '%3N' to support millisecond '%Y-%m-%dT%H:%M:%S.%3N'. This option is used with time_key.

If set to true, it will add all Kubernetes labels to the Stream labels.

If set to true and after extracting labels only a single key remains, the log line sent to Loki will be the value of that key in line_format.

Loki hostname or IP address.

Optional list of record keys that will be placed as stream labels. This configuration property is for records key only.

Specify the label map file path. The file defines how to extract labels from each record.

Stream labels for API request. It can be multiple comma separated of strings specifying key=value pairs. In addition to fixed parameters, it also allows to add custom record keys (similar to label_keys property).

Format to use when flattening the record to a log line. Valid values are json or key_value. If set to json, the log line sent to Loki will be the Fluent Bit record dumped as JSON. If set to key_value, the log line will be each item in the record concatenated together (separated by a single space) in the format.

Loki TCP port

Optional list of keys to remove.

Stream structured metadata for API request. It can be multiple comma separated key=value pairs. This is used for high cardinality data that isn't suited for using labels. Only supported in Loki 3.0+ with schema v13 and TSDB storage.

Optional list of record keys that will be placed as structured metadata. This allows using record accessor patterns (e.g. $kubernetes['pod_name']) to reference record keys.

Specify the name of the key from the original record that contains the Tenant ID. The value of the key is set as X-Scope-OrgID of HTTP header. It is useful to set Tenant ID dynamically.

Limit the maximum number of Chunks in the filesystem for the current output logical destination.

Specify a custom HTTP URI. It must start with forward slash.

Enables dedicated thread(s) for this output. Default value is set since version 1.8.13. For previous versions is 0.

Enable AWS Sigv4 Authentication for Amazon OpenSearch Service.

External ID for the AWS IAM Role specified with aws_role_arn.

Specify the AWS region for Amazon OpenSearch Service.

AWS IAM Role to assume to put records to your Amazon cluster.

Specify the custom sts endpoint to be used with STS API for Amazon OpenSearch Service.

Specify the buffer size used to read the response from the OpenSearch HTTP service. This option is useful for debugging purposes where is required to read full responses, note that response size grows depending of the number of records inserted. To set an unlimited amount of memory set this value to False, otherwise the value must be according to the Unit Size specification.

Use current time for index generation instead of message record

When enabled, generate _id for outgoing records. This prevents duplicate records when retrying OpenSearch.

IP address or hostname of the target OpenSearch instance, default `127.0.0.1`

If set, _id will be the value of the key from incoming record and Generate_ID option is ignored.

When enabled, it append the Tag name to the record.

Index name

Time format (based on strftime) to generate the second part of the Index name.

Enable Logstash format compatibility. This option takes a boolean value: True/False, On/Off

When Logstash_Format is enabled, the Index name is composed using a prefix and the date, e.g: If Logstash_Prefix is equals to 'mydata' your index will become 'mydata-YYYY.MM.DD'. The last string appended belongs to the date when the data is being generated.

Prefix keys with this string

OpenSearch accepts new data on HTTP query path "/_bulk". But it is also possible to serve OpenSearch behind a reverse proxy on a subpath. This option defines such path on the fluent-bit side. It simply adds a path prefix in the indexing HTTP POST URI.

OpenSearch allows to setup filters called pipelines. This option allows to define which pipeline the database should use. For performance reasons is strongly suggested to do parsing and filtering on Fluent Bit side, avoid pipelines.

TCP port of the target OpenSearch instance, default `9200`

When enabled, replace field name dots with underscore, required by Opensearch 2.0-2.3.

When enabled, mapping types is removed and Type option is ignored. Types are deprecated in APIs in v7.0. This options is for v7.0 or later.

When Include_Tag_Key is enabled, this property defines the key name for the tag.

When Logstash_Format is enabled, each record will get a new timestamp field. The Time_Key property defines the name of that field.

When Logstash_Format is enabled, this property defines the format of the timestamp.

When Logstash_Format is enabled, enabling this property sends nanosecond precision timestamps.

Limit the maximum number of Chunks in the filesystem for the current output logical destination.

When enabled print the Opensearch API calls to stdout when Opensearch returns an error

When enabled print the Opensearch API calls to stdout (for diag only)

Type name

Enables dedicated thread(s) for this output. Default value is set since version 1.8.13. For previous versions is 0.

Operation to use to write in bulk requests.

This allows you to add custom labels to all metrics exposed through the OpenTelemetry exporter. You may have multiple of these fields.

Add a HTTP header key/value pair. Multiple headers can be set.

IP address or hostname of the target HTTP Server, default `127.0.0.1`

Log the response payload within the Fluent Bit log.

The log body key to look up in the log events body/message. Sets the Body field of the opentelemtry logs data model.

If true, remaining unmatched keys are added as attributes.

Specify an optional HTTP URI for the target web server listening for logs, e.g: /v1/logs

Specify an optional HTTP URI for the target web server listening for metrics, e.g: /v1/metrics

TCP port of the target OpenSearch instance, default `80`

Specify an HTTP Proxy. The expected format of this value is http://HOST:PORT. Note that HTTPS is not currently supported. It is recommended not to set this and to configure the HTTP proxy environment variables instead as they support both HTTP and HTTPS.

Limit the maximum number of Chunks in the filesystem for the current output logical destination.

Specify an optional HTTP URI for the target web server listening for traces, e.g: /v1/traces

This allows you to add custom labels to all metrics exposed through the prometheus exporter. You may have multiple of these fields

IP address or hostname of the target HTTP Server, default: 0.0.0.0

This is the port Fluent Bit will bind to when hosting prometheus metrics.

This allows you to add custom labels to all metrics exposed through the prometheus exporter. You may have multiple of these fields

Add a HTTP header key/value pair. Multiple headers can be set.

IP address or hostname of the target HTTP Server, default: 127.0.0.1

Log the response payload within the Fluent Bit log,default: false

TCP port of the target HTTP Serveri, default:80

Specify an HTTP Proxy. The expected format of this value is http://HOST:PORT.

Specify an optional HTTP URI for the target web server, e.g: /something ,default: /

Enables dedicated thread(s) for this output. Default value is set since version 1.8.13. For previous versions is 0,default : 2

Immediately retry failed requests to AWS services once.

S3 Bucket name

Predefined Canned ACL Policy for S3 objects.

Compression type for S3 objects.

A standard MIME type for the S3 object; this will be set as the Content-Type HTTP header.

Custom endpoint for the S3 API.

Specify an external ID for the STS API, can be used with the role_arn parameter if your role requires an external ID.

Specify the format of the date. Supported formats are double, epoch, iso8601 (eg: 2018-05-30T09:39:52.000681Z) and java_sql_timestamp (eg: 2018-05-30 09:39:52.000681)

Specify the name of the time key in the output record. To disable the time key just set the value to false.

By default, the whole log record will be sent to S3. If you specify a key name with this option, then only the value of that key will be sent to S3.

Normally, when an upload request fails, there is a high chance for the last received chunk to be swapped with a later chunk, resulting in data shuffling. This feature prevents this shuffling by using a queue logic for uploads.

Option to specify an AWS Profile for credentials.

The AWS region of your S3 bucket

Integer value to set the maximum number of retries allowed.

ARN of an IAM role to assume

Format string for keys in S3.

A series of characters which will be used to split the tag into 'parts' for use with the s3_key_format option.

Send the Content-MD5 header with PutObject and UploadPart requests, as is required when Object Lock is enabled.

Disables behavior where UUID string is automatically appended to end of S3 key name when $UUID is not provided in s3_key_format. $UUID, time formatters, $TAG, and other dynamic key formatters all work as expected while this feature is set to true.

Specify the storage class for S3 objects. If this option is not specified, objects will be stored with the default 'STANDARD' storage class.

Directory to locally buffer data before sending.

The size of the limitation for disk usage in S3.

Custom endpoint for the STS API.

Specifies the size of files in S3. Minimum size is 1M. With use_put_object On the maximum size is 1G. With multipart upload mode, the maximum size is 50G.

The size of each 'part' for multipart uploads. Max: 50M

Whenever this amount of time has elapsed, Fluent Bit will complete an upload and create a new file in S3. For example, set this value to 60m and you will get a new file every hour.

Use the S3 PutObject API, instead of the multipart upload API.

Specify number of worker threads to use to output to S3

Enables dedicated thread(s) for this output. Default value `2` is set since version 1.8.13. For previous versions is 0.

Specify X-Splunk-Request-Channel Header for the HTTP Event Collector interface.

Set payload compression mechanism. The only available option is gzip.

Set event fields for the record. This option is an array and the format is "key_name record_accessor_pattern".

Specify the key name that contains the host value. This option allows a record accessors pattern.

The name of the index by which the event data is to be indexed.

Set a record key that will populate the index field. If the key is found, it will have precedence over the value set in event_index.

Specify the key name that will be used to send a single value as part of the record.

Set the source value to assign to the event data.

Set the sourcetype value to assign to the event data.

Set a record key that will populate 'sourcetype'. If the key is found, it will have precedence over the value set in event_sourcetype.

IP address or hostname of the target OpenSearch instance, default `127.0.0.1`

Buffer size used to receive Splunk HTTP responses: Default `2M`

If the HTTP server response code is 400 (bad request) and this flag is enabled, it will print the full HTTP request and response to the stdout interface. This feature is available for debugging purposes.

TCP port of the target Splunk instance, default `8088`

When enabled, the record keys and values are set in the top level of the map instead of under the event key. Refer to the Sending Raw Events section from the docs more details to make this option work properly.

Rewrite the trace field to be formatted for use with GCP Cloud Trace

A custom regex to extract fields from the local_resource_id of the logs

The GCP Project that should receive the logs

Path to GCP Credentials JSON file

Identifier for a grouping of tasks. Required if Resource is generic_task

Location of the cluster that contains the pods/nodes. Required if Resource is k8s_container, k8s_node, or k8s_pod

Name of the cluster that the pod is running in. Required if Resource is k8s_container, k8s_node, or k8s_pod

Optional list of comma separated of strings for key/value pairs

Used by Stackdriver to find related labels and extract them to LogEntry Labels

GCP/AWS region to store data. Required if Resource is generic_node or generic_task

The value of this field is set as the logName field in Stackdriver

Metadata Server Prefix

Namespace identifier. Required if Resource is generic_node or generic_task

Node identifier within the namespace. Required if Resource is generic_node or generic_task

Set resource types of data

Optional list of comma separated strings. Setting these fields overrides the Stackdriver monitored resource API values

Specify the key that contains the severity information for the logs

Used to validate the tags of logs that when the Resource is k8s_container, k8s_node, or k8s_pod

Identifier for a task within a namespace. Required if Resource is generic_task

The key used to select the text payload from the record

Number of dedicated threads for the Stackdriver Output Plugin

Specify the data format to be printed. Supported formats are msgpack json, json_lines and json_stream.

Specify the format of the date. Supported formats are double, iso8601 (eg: 2018-05-30T09:39:52.000681Z) and epoch.

Specify the name of the date field in output.

Host domain or IP address of the remote Syslog server.

Mode of the desired transport type, the available options are tcp, tls and udp.

TCP or UDP port of the remote Syslog server.

Key name from the original record that contains the application name that generated the message.

Key from the original record that contains the Syslog facility number.

Syslog protocol format to use, the available options are rfc3164 and rfc5424.

Key name from the original record that contains the hostname that generated the message.

Maximum size allowed per message, in bytes.

Key name from the original record that contains the Message ID associated to the message.

Key key name that contains the message to deliver.

Key name from the original record that contains the Process ID that generated the message.

Key name from the original record that contains the Structured Data (SD) content.

Key from the original record that contains the Syslog severity number.

Limit the maximum number of Chunks in the filesystem for the current output logical destination.

Enables dedicated thread(s) for this output. Default value is set since version 1.8.13. For previous versions is 0.

Specify the data format to be printed. Supported formats are msgpack json, json_lines and json_stream.

Target host where Fluent-Bit or Fluentd are listening for Forward messages.

Specify the format of the date. Supported formats are double, epoch and iso8601 (eg: 2018-05-30T09:39:52.000681Z)

TSpecify the name of the time key in the output record. To disable the time key just set the value to false.

TCP Port of the target service.