Passthrough

The smallest parser that does anything useful: it prints the timestamp, size and source of every record it sees to the console, marks the record as an event, and passes it on unchanged. Start here when you are onboarding a format you have not seen before — run it, read what the console shows you, and build the real parser from that. See Processors for the editor and its console panel.

The Parser

function main({obj, size, source}) {
   printf("hello world: ts: %d, size: %d, source: %s", obj["@timestamp"], size, source)
   obj["@type"] = "event"
   return "pass"
}