From e05405ded13908ca137f44ecf998f3719a68f147 Mon Sep 17 00:00:00 2001
From: Hank Leininger <hlein@korelogic.com>
Date: Sat, 15 Nov 2025 21:25:18 -0700
Subject: [PATCH 1/7] conf: parser_custom.conf: remove leading whitespace, fix
 parse error

Previously, trying to use this file resulted in:

[2025/11/15 21:23:49.103609095] [error] [config] error in parser_custom.conf:1: undefined value - check config is in valid classic format

Signed-off-by: Hank Leininger <hlein@korelogic.com>
---
 conf/parser_custom.conf | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/conf/parser_custom.conf b/conf/parser_custom.conf
index 51e81985e09..63c439e085c 100644
--- a/conf/parser_custom.conf
+++ b/conf/parser_custom.conf
@@ -1,14 +1,14 @@
- [PARSER]
+[PARSER]
       # https://rubular.com/r/6ZCuwV4Xa7nfA3
       Name                rabbitmq
       Format              regex
       Regex               (?<date>[^ ]+)\s(?<time>[^ ]+)\s\[(?<log_level>[^ \]]*)\]\s(?<PID>[^ ]*)\s(?<msg>((([a-zA-Z]*\s+)+[^ ]*)+)+)
- [PARSER]
+[PARSER]
       # https://rubular.com/r/jWfJIOMKr2LgcO
       Name                neo4j
       Format              regex
       Regex               (?<date>[^ ]*) (?<time>[^ ]*) (?<log_level>[^ ]*)\s(?<msg>([^ ]*\s+[^ ]*)+)
- [PARSER]
+[PARSER]
       # https://rubular.com/r/U8VbByp0oRPLU6
       Name                external-dns
       Format              regex

From 8a12573cbd16f24ed0dd547eb43d2809127254a6 Mon Sep 17 00:00:00 2001
From: Hank Leininger <hlein@korelogic.com>
Date: Sun, 16 Nov 2025 13:36:05 -0700
Subject: [PATCH 2/7] conf: parser: added a reference to a test-case for
 syslog-rfc3164

Signed-off-by: Hank Leininger <hlein@korelogic.com>
---
 conf/parsers.conf | 1 +
 1 file changed, 1 insertion(+)

diff --git a/conf/parsers.conf b/conf/parsers.conf
index 4914b0802ba..9b46376bd44 100644
--- a/conf/parsers.conf
+++ b/conf/parsers.conf
@@ -82,6 +82,7 @@
     Time_Keep   On
 
 [PARSER]
+    # https://rubular.com/r/y5tae3pzf6sOHW
     Name        syslog-rfc3164
     Format      regex
     Regex       /^\<(?<pri>[0-9]+)\>(?<time>[^ ]* {1,2}[^ ]* [^ ]*) (?<host>[^ ]*) (?<ident>[a-zA-Z0-9_\/\.\-]*)(?:\[(?<pid>[0-9]+)\])?(?:[^\:]*\:)? *(?<message>.*)$/

From 375079ef00ef29b2b74b4367ee82d3dacc1b832c Mon Sep 17 00:00:00 2001
From: Hank Leininger <hlein@korelogic.com>
Date: Sat, 15 Nov 2025 21:36:58 -0700
Subject: [PATCH 3/7] conf: parser: Convert all http://rubular.com/ links to
 https://

Signed-off-by: Hank Leininger <hlein@korelogic.com>
---
 conf/parsers.conf        | 2 +-
 conf/parsers_cinder.conf | 2 +-
 conf/parsers_extra.conf  | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/conf/parsers.conf b/conf/parsers.conf
index 9b46376bd44..db78ab1c266 100644
--- a/conf/parsers.conf
+++ b/conf/parsers.conf
@@ -117,7 +117,7 @@
     Time_Key start_time
 
 [PARSER]
-    # http://rubular.com/r/tjUt3Awgg4
+    # https://rubular.com/r/tjUt3Awgg4
     Name cri
     Format regex
     Regex ^(?<time>[^ ]+) (?<stream>stdout|stderr) (?<logtag>[^ ]*) (?<message>.*)$
diff --git a/conf/parsers_cinder.conf b/conf/parsers_cinder.conf
index b67ee99a80f..282ffdd6759 100644
--- a/conf/parsers_cinder.conf
+++ b/conf/parsers_cinder.conf
@@ -1,6 +1,6 @@
 
 [PARSER]
-    # http://rubular.com/r/IvZVElTgNl
+    # https://rubular.com/r/IvZVElTgNl
     Name ceph
     Format regex
     Regex ^(?<log_time>[^ ][-.\d\+:T]+[ ]*[.:\d]*)\s+(?<message>.*)$
diff --git a/conf/parsers_extra.conf b/conf/parsers_extra.conf
index afe48c1aea2..3cca8faffba 100644
--- a/conf/parsers_extra.conf
+++ b/conf/parsers_extra.conf
@@ -1,7 +1,7 @@
 # Extra set of common parsers
 
 [PARSER]
-    # http://rubular.com/r/cCVd1HLCAO
+    # https://rubular.com/r/cCVd1HLCAO
     Name crowbar
     Format regex
     Regex ^.*\[(?<log_time>[^ ][-.\d\+:]+T[:\d]*)([^\]])*?\]\s+?(?<severity>[^ ]\w+)([\s-]*):?\s+(?<message>.*)
@@ -10,7 +10,7 @@
     Time_Key log_time
 
 [PARSER]
-    # http://rubular.com/r/frDgnElXW9 
+    # https://rubular.com/r/frDgnElXW9 
     Name chefclient
     Format regex
     Regex ^\[(?<log_time>[^ ][-.\d\+:]+T[:\d]*)([^\]])*?\]\s+(?<severity>[^ ]\w+):\s+(?<message>.*)$

From d0b9e59c227c8d4cd210ec3a7e54cd252209c9e1 Mon Sep 17 00:00:00 2001
From: Hank Leininger <hlein@korelogic.com>
Date: Sun, 16 Nov 2025 00:27:38 -0700
Subject: [PATCH 4/7] tests: config_format: Add converter and tests for parser
 .conf -> .yaml

Signed-off-by: Hank Leininger <hlein@korelogic.com>
---
 .../data/config_format/convert/.gitignore     |   2 +
 .../data/config_format/convert/README         |  20 +
 .../convert/fb-parser-conf2yaml.pl            | 492 ++++++++++++++++++
 .../convert/parser_custom.external-dns.test   |   1 +
 .../convert/parser_custom.neo4j.test          |   1 +
 .../convert/parser_custom.rabbitmq.test       |   1 +
 .../config_format/convert/parsers.cri.test    |   2 +
 .../config_format/convert/parsers.envoy.test  |   1 +
 .../convert/parsers.istio-envoy-proxy.test    |   1 +
 .../convert/parsers.k8s-nginx-ingress.test    |   1 +
 .../convert/parsers.kmsg-netfilter-log.test   |   2 +
 .../convert/parsers.syslog-rfc3164.test       |   1 +
 .../convert/parsers_cinder.ceph.test          |  10 +
 .../convert/parsers_extra.chefclient.test     |  30 ++
 ...arsers_extra.couchbase_java_multiline.test |  11 +
 ...sers_extra.couchbase_simple_log_mixed.test |   3 +
 ...arsers_extra.couchbase_simple_log_utc.test |   5 +
 .../convert/parsers_extra.crowbar.test        |  20 +
 .../data/config_format/convert/run_tests.sh   | 100 ++++
 19 files changed, 704 insertions(+)
 create mode 100644 tests/internal/data/config_format/convert/.gitignore
 create mode 100644 tests/internal/data/config_format/convert/README
 create mode 100755 tests/internal/data/config_format/convert/fb-parser-conf2yaml.pl
 create mode 100644 tests/internal/data/config_format/convert/parser_custom.external-dns.test
 create mode 100644 tests/internal/data/config_format/convert/parser_custom.neo4j.test
 create mode 100644 tests/internal/data/config_format/convert/parser_custom.rabbitmq.test
 create mode 100644 tests/internal/data/config_format/convert/parsers.cri.test
 create mode 100644 tests/internal/data/config_format/convert/parsers.envoy.test
 create mode 100644 tests/internal/data/config_format/convert/parsers.istio-envoy-proxy.test
 create mode 100644 tests/internal/data/config_format/convert/parsers.k8s-nginx-ingress.test
 create mode 100644 tests/internal/data/config_format/convert/parsers.kmsg-netfilter-log.test
 create mode 100644 tests/internal/data/config_format/convert/parsers.syslog-rfc3164.test
 create mode 100644 tests/internal/data/config_format/convert/parsers_cinder.ceph.test
 create mode 100644 tests/internal/data/config_format/convert/parsers_extra.chefclient.test
 create mode 100644 tests/internal/data/config_format/convert/parsers_extra.couchbase_java_multiline.test
 create mode 100644 tests/internal/data/config_format/convert/parsers_extra.couchbase_simple_log_mixed.test
 create mode 100644 tests/internal/data/config_format/convert/parsers_extra.couchbase_simple_log_utc.test
 create mode 100644 tests/internal/data/config_format/convert/parsers_extra.crowbar.test
 create mode 100755 tests/internal/data/config_format/convert/run_tests.sh

diff --git a/tests/internal/data/config_format/convert/.gitignore b/tests/internal/data/config_format/convert/.gitignore
new file mode 100644
index 00000000000..6c8a98e74af
--- /dev/null
+++ b/tests/internal/data/config_format/convert/.gitignore
@@ -0,0 +1,2 @@
+*.conf
+*.yaml
diff --git a/tests/internal/data/config_format/convert/README b/tests/internal/data/config_format/convert/README
new file mode 100644
index 00000000000..c53f7d42daf
--- /dev/null
+++ b/tests/internal/data/config_format/convert/README
@@ -0,0 +1,20 @@
+Convert parser .conf files to .yaml, and validate they behave the same.
+
+fb-parser-conf2yaml.pl can convert all conf/parser*conf files.
+
+parser*.test files are the example logs linked to in existing .conf files.
+
+To use:
+
+- copy parser .conf files to pwd, like:
+
+  cp ../../../../../conf/parser*conf .
+
+- convert them all:
+
+  ./fb-parser-conf2yaml.pl *.conf
+
+To test:
+
+  ./run_tests.sh
+
diff --git a/tests/internal/data/config_format/convert/fb-parser-conf2yaml.pl b/tests/internal/data/config_format/convert/fb-parser-conf2yaml.pl
new file mode 100755
index 00000000000..a8ffea6e252
--- /dev/null
+++ b/tests/internal/data/config_format/convert/fb-parser-conf2yaml.pl
@@ -0,0 +1,492 @@
+#!/usr/bin/env perl
+use strict;
+use warnings;
+use utf8;
+
+# Convert Fluent Bit parser .conf files to YAML format
+#
+# N.B.:
+#
+# - Currently only supports parser*.conf files, not other .conf files.
+#
+# - Uses hardcoded indentations to match existing examples.
+#
+# - Does not handle escaped quotes inside 'rule' parameters. No instances
+#   of that found in the current source tree.
+#
+# - Supports up to one [PARSER] followed by up to one [MULTILINE_PARSER],
+#   which covers every existing example, but might not actually be
+#   a hard requirement of Fluent Bit's .conf format.
+
+# Simple key:value keywords we can rewrite when we see them commented out
+my @KNOWN_KEYWORDS = qw(
+	Format Name Regex Time_Keep Time_Key Time_Format Types
+);
+
+# Build a case-insensitive regex from those keywords
+my $keyword_pattern = join('|', map { quotemeta($_) } @KNOWN_KEYWORDS);
+my $keyword_regex = qr/^#\s*($keyword_pattern)\s+(.+)$/i;
+
+sub parse_rule_value
+{
+  my ($value) = @_;
+  
+  # Parse rule format: "state" "regex" "next_state"
+  if ($value =~ /^\s*"([^"]*)"\s+"([^"]*)"\s+"([^"]*)"/)
+  {
+    return
+    {
+      state => $1,
+      regex => $2,
+      next_state => $3
+    };
+  }
+  
+  return undef;  # Parsing failed
+}
+
+sub transform_commented_keyword
+{
+  my ($stripped) = @_;
+  
+  return $stripped unless $stripped =~ $keyword_regex;
+  
+  my ($key, $value) = ($1, $2);
+  my $yaml_key = lc($key);
+  
+  # Transform to YAML key:value format
+  my $yaml_value = &format_yaml_value($value);
+  return "#$yaml_key: $yaml_value";
+}
+
+sub parse_conf_file
+{
+  my ($content) = @_;
+  my @parsers;
+  my @multiline_parsers;
+  my $rhcurrent_parser;
+  # 'PARSER' or 'MULTILINE_PARSER'
+  my $current_type;
+  my @pending_comments;
+  my $parser_has_fields = 0;
+  # There may be global comments before stanzas start
+  my @file_comments;
+  my $seen_section = 0;
+  # Track if there's a blank before a comment block, so we know
+  # whether to merge into the stanza above or not.
+  my $blank_before_comments = 0;
+  # There may be global comments at end of file
+  my @trailing_comments;
+  
+  for my $line (split /\n/, $content)
+  {
+    my $stripped = $line;
+    $stripped =~ s/^\s+|\s+$//g;  # trim
+    
+    # Skip empty lines
+    if (!$stripped)
+    {
+      # If we have pending comments, this blank line might separate them from next section
+      if (@pending_comments)
+      {
+        push @pending_comments, '';
+      }
+      else
+      {
+        # Mark that we've seen a blank line (potentially before comments)
+        $blank_before_comments = 1;
+      }
+      next;
+    }
+    
+    # Collect comments
+    if ($stripped =~ /^#/)
+    {
+      push @pending_comments, &transform_commented_keyword($stripped);
+      next;
+    }
+    
+    # Check for section headers
+    if ($stripped =~ /^\[(\w+)\]$/)
+    {
+      # Normalize to uppercase
+      my $section = uc($1);
+      
+      # Save comments before first section as file-level comments
+      if (!$seen_section && @pending_comments)
+      {
+        @file_comments = @pending_comments;
+        @pending_comments = ();
+        $blank_before_comments = 0;
+      }
+      $seen_section = 1;
+      
+      # If we have pending comments with a blank line before them,
+      # they belong to the new section (leading comments)
+      # Otherwise they belong to the previous section (trailing comments)
+      my $rapending_for_save;
+      if (@pending_comments && !$blank_before_comments)
+      {
+        # Comments belong to previous parser (no blank line before them)
+        if ($rhcurrent_parser)
+        {
+          $rhcurrent_parser->{_inline_comments} //= [];
+          push @{$rhcurrent_parser->{_inline_comments}}, @pending_comments;
+        }
+        @pending_comments = ();
+        $rapending_for_save = \@pending_comments;  # Empty array ref
+      }
+      elsif (@pending_comments && $blank_before_comments)
+      {
+        # Comments belong to next parser - don't pass to save_current_parser
+        $rapending_for_save = [];  # Empty array ref
+      }
+      else
+      {
+        # No pending comments
+        $rapending_for_save = \@pending_comments;
+      }
+      
+      # Save previous parser
+      &save_current_parser($rhcurrent_parser, $current_type, $rapending_for_save, 
+        \@parsers, \@multiline_parsers);
+      
+      # Reset blank line flag after processing
+      $blank_before_comments = 0;
+
+      if ($section eq 'PARSER' || $section eq 'MULTILINE_PARSER')
+      {
+        $current_type = $section;
+        $rhcurrent_parser =
+        {
+          _comments => [],
+          _fields => []
+        };
+        $parser_has_fields = 0;
+        
+        # Attach any pending comments to this parser (leading comments with blank before)
+        if (@pending_comments)
+        {
+          $rhcurrent_parser->{_comments} = [@pending_comments];
+          @pending_comments = ();
+        }
+      }
+      else
+      {
+        # Unsupported section type
+        warn "Warning: Unsupported section type [$section] - can only handle [PARSER] and [MULTILINE_PARSER]\n";
+        $rhcurrent_parser = undef;
+        $current_type = undef;
+      }
+      next;
+    }
+    
+    # Parse key-value pairs
+    if ($rhcurrent_parser && $stripped =~ /^(\S+)\s+(.+)$/)
+    {
+      my ($key, $value) = ($1, $2);
+      
+      # Reset blank line flag when we see actual content
+      $blank_before_comments = 0;
+      
+      # If we have pending comments, add them before this field
+      if (@pending_comments)
+      {
+        if (!$parser_has_fields)
+        {
+          # Comments before any fields are leading comments
+          push @{$rhcurrent_parser->{_comments}}, @pending_comments;
+        }
+        else
+        {
+          # Comments after first field - store inline with fields
+          for my $comment (@pending_comments)
+          {
+            push @{$rhcurrent_parser->{_fields}}, ['_comment_', $comment];
+          }
+        }
+        @pending_comments = ();
+      }
+      
+      # Convert key to lowercase with underscores
+      my $yaml_key = lc($key);
+      
+      # Special handling for multiline parser 'rule' fields
+      if ($current_type eq 'MULTILINE_PARSER' && $yaml_key eq 'rule')
+      {
+        my $rhrule = &parse_rule_value($value);
+        if ($rhrule)
+        {
+          # Store as a structured rule
+          push @{$rhcurrent_parser->{_fields}}, ['_rule_', $rhrule];
+        }
+        else
+        {
+          # Fallback: store as-is if parsing fails
+          warn "Warning: Could not parse rule format: $value\n";
+          push @{$rhcurrent_parser->{_fields}}, [$yaml_key, $value];
+        }
+      }
+      else
+      {
+        # Store field in order
+        push @{$rhcurrent_parser->{_fields}}, [$yaml_key, $value];
+      }
+      $parser_has_fields = 1;
+    }
+  }
+  
+  # Handle any remaining comments at end of file
+  # If there's a blank line before them, they're trailing file comments
+  if (@pending_comments && $blank_before_comments)
+  {
+    @trailing_comments = @pending_comments;
+    @pending_comments = ();
+  }
+  
+  # Don't forget the last parser and any trailing comments
+  &save_current_parser($rhcurrent_parser, $current_type, \@pending_comments,
+    \@parsers, \@multiline_parsers);
+  
+  return (\@file_comments, \@parsers, \@multiline_parsers, \@trailing_comments);
+}
+
+sub format_yaml_value
+{
+  my ($value) = @_;
+  
+  # Check if value needs quoting
+  # Quote values that start with special chars or contain : or # or %
+  if ($value && 
+    ($value =~ /^[!&*{\[|>'"]/ || 
+     $value =~ /[:#]/ || 
+     $value =~ /^%/))
+  {
+    # Use single quotes and escape any single quotes in the value
+    $value =~ s/'/''/g;
+    return "'$value'";
+  }
+  
+  return $value;
+}
+
+sub output_comments
+{
+  my ($racomments, $ralines, $indent) = @_;
+  $indent //= '';
+  
+  for my $comment (@$racomments)
+  {
+    if ($comment)
+    {
+      push @$ralines, "$indent$comment";
+    }
+    else
+    {
+      push @$ralines, "$indent#";
+    }
+  }
+}
+
+sub save_current_parser
+{
+  my ($rhcurrent_parser, $current_type, $rapending_comments, $raparsers, $ramultiline_parsers) = @_;
+  
+  return unless $rhcurrent_parser;
+  
+  # Add any remaining inline comments
+  if (@$rapending_comments)
+  {
+    $rhcurrent_parser->{_inline_comments} //= [];
+    push @{$rhcurrent_parser->{_inline_comments}}, @$rapending_comments;
+    @$rapending_comments = ();
+  }
+  
+  # Save to appropriate list
+  if ($current_type eq 'PARSER')
+  {
+    push @$raparsers, $rhcurrent_parser;
+  }
+  elsif ($current_type eq 'MULTILINE_PARSER')
+  {
+    push @$ramultiline_parsers, $rhcurrent_parser;
+  }
+}
+
+sub output_section
+{
+  my ($section_name, $raitems, $ralines) = @_;
+  
+  return unless @$raitems;
+  
+  # Insert a blank line between sections
+  push @$ralines, '' if @$ralines;
+
+  push @$ralines, "$section_name:";
+  
+  for my $idx (0 .. $#$raitems)
+  {
+    # Insert a blank line between items
+    push @$ralines, '' if $idx > 0;
+
+    &output_parser_item($raitems->[$idx], $ralines);
+  }
+}
+
+sub output_parser_item
+{
+  my ($rhparser, $ralines) = @_;
+  
+  # Extract and remove comments from the parser hash
+  my @comments = @{delete $rhparser->{_comments} // []};
+  my @inline_comments = @{delete $rhparser->{_inline_comments} // []};
+  my @fields = @{delete $rhparser->{_fields} // []};
+  
+  # Collect rules for multiline parsers
+  my @rules;
+  my @non_rule_fields;
+  for my $rafield (@fields)
+  {
+    my ($key, $value) = @$rafield;
+    if ($key eq '_rule_')
+    {
+      push @rules, $value;
+    }
+    else
+    {
+      push @non_rule_fields, $rafield;
+    }
+  }
+  
+  # Start the parser list item
+  my $first_field = 1;
+  for my $rafield (@non_rule_fields)
+  {
+    my ($key, $value) = @$rafield;
+    
+    # Handle inline comments
+    if ($key eq '_comment_')
+    {
+      if ($value)
+      {
+        push @$ralines, "    $value";
+      }
+      else
+      {
+        push @$ralines, '    #';
+      }
+      next;
+    }
+    
+    if ($first_field)
+    {
+      # First field gets the list marker
+      push @$ralines, "  - $key: " . &format_yaml_value($value);
+      $first_field = 0;
+      
+      # Add leading comments after the name field
+      &output_comments(\@comments, $ralines, '    ');
+    }
+    else
+    {
+      # Subsequent fields are indented
+      push @$ralines, "    $key: " . &format_yaml_value($value);
+    }
+  }
+  
+  # Output rules array if we have any
+  if (@rules)
+  {
+    push @$ralines, "    rules:";
+    for my $idx (0 .. $#rules)
+    {
+      my $rhrule = $rules[$idx];
+      
+      # Add blank line before rules after the first one
+      push @$ralines, '' if $idx > 0;
+      
+      push @$ralines, "      - state: $rhrule->{state}";
+      push @$ralines, "        regex: " . &format_yaml_value($rhrule->{regex});
+      push @$ralines, "        next_state: $rhrule->{next_state}";
+    }
+  }
+  
+  # Add trailing inline comments
+  &output_comments(\@inline_comments, $ralines, '    ');
+}
+
+sub convert_to_yaml
+{
+  my ($rafile_comments, $raparsers, $ramultiline_parsers, $ratrailing_comments) = @_;
+  my @lines;
+  
+  # Add file-level comments at the top
+  &output_comments($rafile_comments, \@lines);
+  
+  # Output sections
+  &output_section('parsers', $raparsers, \@lines);
+  &output_section('multiline_parsers', $ramultiline_parsers, \@lines);
+  
+  # Add trailing comments at the end
+  if (@$ratrailing_comments)
+  {
+    push @lines, '';  # Blank line before trailing comments
+    &output_comments($ratrailing_comments, \@lines);
+  }
+  
+  return join("\n", @lines) . "\n";
+}
+
+# Main
+if (@ARGV < 1)
+{
+  print "Usage: fb-parser-conf2yaml.pl <input1.conf> [input2.conf ...]\n";
+  print "Converts each input file to YAML, creating output files with .yaml suffix\n";
+  exit 1;
+}
+
+for my $input_file (@ARGV)
+{
+  # Check if input file exists
+  unless (-f $input_file)
+  {
+    warn "Warning: Input file '$input_file' not found, skipping\n";
+    next;
+  }
+  
+  # Generate output filename
+  my $output_file = $input_file;
+  $output_file =~ s/\.(conf|config|cnf|cfg)$//i;  # Strip common config extensions
+  $output_file .= '.yaml';
+  
+  # Check if output file already exists and has nonzero size
+  if (-s $output_file)
+  {
+    warn "Warning: Output file '$output_file' already exists and is non-empty, skipping\n";
+    next;
+  }
+  
+  # Read the input file
+  open my $fh, '<:utf8', $input_file or do
+  {
+    warn "Warning: Cannot open '$input_file': $!, skipping\n";
+    next;
+  };
+  my $content = do { local $/; <$fh> };
+  close $fh;
+  
+  # Parse and convert
+  my ($rafile_comments, $raparsers, $ramultiline_parsers, $ratrailing_comments) = &parse_conf_file($content);
+  my $yaml_output = &convert_to_yaml($rafile_comments, $raparsers, $ramultiline_parsers, $ratrailing_comments);
+  
+  # Write output
+  open my $out_fh, '>:utf8', $output_file or do
+  {
+    warn "Warning: Cannot write '$output_file': $!, skipping\n";
+    next;
+  };
+  print $out_fh $yaml_output;
+  close $out_fh;
+  
+  print "Converted $input_file -> $output_file\n";
+}
diff --git a/tests/internal/data/config_format/convert/parser_custom.external-dns.test b/tests/internal/data/config_format/convert/parser_custom.external-dns.test
new file mode 100644
index 00000000000..e5e0ef68b98
--- /dev/null
+++ b/tests/internal/data/config_format/convert/parser_custom.external-dns.test
@@ -0,0 +1 @@
+'time="2021-10-28T05:29:08Z" level=info msg="All records are already up to date"'
diff --git a/tests/internal/data/config_format/convert/parser_custom.neo4j.test b/tests/internal/data/config_format/convert/parser_custom.neo4j.test
new file mode 100644
index 00000000000..08fc1e671d2
--- /dev/null
+++ b/tests/internal/data/config_format/convert/parser_custom.neo4j.test
@@ -0,0 +1 @@
+2021-10-01 23:14:38.390+0000 INFO  Bound database 'core' to raft with id '3fa5a63d-cbf3-4306-afa5-2aad821887be', found on disk. 
diff --git a/tests/internal/data/config_format/convert/parser_custom.rabbitmq.test b/tests/internal/data/config_format/convert/parser_custom.rabbitmq.test
new file mode 100644
index 00000000000..c115663b29b
--- /dev/null
+++ b/tests/internal/data/config_format/convert/parser_custom.rabbitmq.test
@@ -0,0 +1 @@
+2021-11-15 07:10:27.454 [info] <0.27489.3> Closing all channels from connection '10.171.85.133:59510 -> 10.171.91.132:5672' because it has been closed
diff --git a/tests/internal/data/config_format/convert/parsers.cri.test b/tests/internal/data/config_format/convert/parsers.cri.test
new file mode 100644
index 00000000000..6aa9115670d
--- /dev/null
+++ b/tests/internal/data/config_format/convert/parsers.cri.test
@@ -0,0 +1,2 @@
+2018-02-13T07:59:37.505201169-05:00 stdout F line 1 user=A id=foo
+2018-02-13T08:00:17.666563371-05:00 stdout F line 2 user= stdout F id=bar
diff --git a/tests/internal/data/config_format/convert/parsers.envoy.test b/tests/internal/data/config_format/convert/parsers.envoy.test
new file mode 100644
index 00000000000..6dcfc70001c
--- /dev/null
+++ b/tests/internal/data/config_format/convert/parsers.envoy.test
@@ -0,0 +1 @@
+[2016-04-15T20:17:00.310Z] "POST /api/v1/locations HTTP/2" 204 - 154 0 226 100 "10.0.35.28" "nsq2http" "cc21d9b0-cf5c-432b-8c7e-98aeb7988cd2" "locations" "tcp://10.0.2.1:80"
diff --git a/tests/internal/data/config_format/convert/parsers.istio-envoy-proxy.test b/tests/internal/data/config_format/convert/parsers.istio-envoy-proxy.test
new file mode 100644
index 00000000000..647620a57fe
--- /dev/null
+++ b/tests/internal/data/config_format/convert/parsers.istio-envoy-proxy.test
@@ -0,0 +1 @@
+[2020-11-25T21:26:18.409Z] "GET /status/418 HTTP/1.1" 418 - via_upstream - "-" 0 135 3 1 "-" "curl/7.73.0-DEV" "84961386-6d84-929d-98bd-c5aee93b5c88" "httpbin:8000" "127.0.0.1:80" inbound|8000|| 127.0.0.1:41854 10.44.1.27:80 10.44.1.23:37652 outbound_.8000_._.httpbin.foo.svc.cluster.local default
diff --git a/tests/internal/data/config_format/convert/parsers.k8s-nginx-ingress.test b/tests/internal/data/config_format/convert/parsers.k8s-nginx-ingress.test
new file mode 100644
index 00000000000..01330892012
--- /dev/null
+++ b/tests/internal/data/config_format/convert/parsers.k8s-nginx-ingress.test
@@ -0,0 +1 @@
+100.100.93.64 - redacted-user [26/Jan/2020:19:05:42 +0000] "POST /api/open/v1/redact/redacted HTTP/1.1" 200 34152 "-" "Go-http-client/1.1" 308 7.234 [redacted-http] [] 101.86.32.129:8080 34152 7.232 200 342434ed44ad21c7622b3c4590ec280e
diff --git a/tests/internal/data/config_format/convert/parsers.kmsg-netfilter-log.test b/tests/internal/data/config_format/convert/parsers.kmsg-netfilter-log.test
new file mode 100644
index 00000000000..cd07f939051
--- /dev/null
+++ b/tests/internal/data/config_format/convert/parsers.kmsg-netfilter-log.test
@@ -0,0 +1,2 @@
+<4>1 2024-05-16T19:26:03.944208+01:00 gw-stl-a1 kernel - - - [645464.777320] FIREWALL IN=enp1s0 OUT= MAC=94:2b:f3:a0:10:af:00:00:5e:00:01:2b:08:00 SRC=192.168.1.123 DST=192.168.1.1 LEN=40 TOS=0x00 PREC=0x00 TTL=239 ID=34391 PROTO=TCP SPT=42694 DPT=10005 WINDOW=1024 RES=0x00 SYN URGP=0
+<4>1 2024-05-16T19:33:42.553578+01:00 gw-stl-a1 kernel - - - [645923.403489] FIREWALL IN=enp3s0.12 OUT=enp3s0.11 MAC=94:2b:f3:a0:10:af:9c:b6:d0:d6:a1:af:08:00 SRC=192.168.91.200 DST=192.168.96.3 LEN=152 TOS=0x00 PREC=0x00 TTL=63 ID=7769 DF PROTO=UDP SPT=41641 DPT=41641 LEN=132
diff --git a/tests/internal/data/config_format/convert/parsers.syslog-rfc3164.test b/tests/internal/data/config_format/convert/parsers.syslog-rfc3164.test
new file mode 100644
index 00000000000..adc98ca723f
--- /dev/null
+++ b/tests/internal/data/config_format/convert/parsers.syslog-rfc3164.test
@@ -0,0 +1 @@
+<34>Oct 11 22:14:15 mymachine su: 'su root' failed for lonvick on /dev/pts/8
diff --git a/tests/internal/data/config_format/convert/parsers_cinder.ceph.test b/tests/internal/data/config_format/convert/parsers_cinder.ceph.test
new file mode 100644
index 00000000000..40edbfca21e
--- /dev/null
+++ b/tests/internal/data/config_format/convert/parsers_cinder.ceph.test
@@ -0,0 +1,10 @@
+2017-11-23 00:00:01.472591 7fa664005700 -1 received  signal: Hangup from  PID: 3101709 task name: killall -q -1 ceph-mon ceph-mgr ceph-mds ceph-osd ceph-fuse radosgw  UID: 0
+2017-11-23 00:00:01.474260 7f213804f700 -1 received  signal: Hangup from  PID: 3101709 task name: killall -q -1 ceph-mon ceph-mgr ceph-mds ceph-osd ceph-fuse radosgw  UID: 0
+2017-11-23 00:00:01.474543 7fa4cec7b700 -1 received  signal: Hangup from  PID: 3101709 task name: killall -q -1 ceph-mon ceph-mgr ceph-mds ceph-osd ceph-fuse radosgw  UID: 0
+2017-11-23 00:00:01.474669 7f1b01352700 -1 received  signal: Hangup from  PID: 3101709 task name: killall -q -1 ceph-mon ceph-mgr ceph-mds ceph-osd ceph-fuse radosgw  UID: 0
+2017-11-23 00:00:01.474793 7f1967203700 -1 received  signal: Hangup from  PID: 3101709 task name: killall -q -1 ceph-mon ceph-mgr ceph-mds ceph-osd ceph-fuse radosgw  UID: 0
+2017-11-23 06:02:05.349535 7ff2b075a700  0 -- 192.168.132.30:6818/6907 >> 192.168.132.52:6824/7318 conn(0x55aa03987000 :6818 s=STATE_ACCEPTING_WAIT_CONNECT_MSG_AUTH pgs=0 cs=0 l=0).handle_connect_msg accept connect_seq 16 vs existing csq=15 existing_state=STATE_STANDBY
+2017-11-23 06:03:58.988784 7ff2b075a700  0 -- 192.168.132.30:6818/6907 >> 192.168.132.31:6802/6015 conn(0x55a9fe229800 :6818 s=STATE_ACCEPTING_WAIT_CONNECT_MSG_AUTH pgs=0 cs=0 l=0).handle_connect_msg accept connect_seq 19 vs existing csq=19 existing_state=STATE_STANDBY
+2017-11-23 06:03:58.988876 7ff2b075a700  0 -- 192.168.132.30:6818/6907 >> 192.168.132.31:6802/6015 conn(0x55a9fe229800 :6818 s=STATE_ACCEPTING_WAIT_CONNECT_MSG_AUTH pgs=0 cs=0 l=0).handle_connect_msg accept connect_seq 20 vs existing csq=19 existing_state=STATE_STANDBY
+2017-11-23 06:29:44.953262 7ff2b0f5b700  0 -- 192.168.132.30:6818/6907 >> 192.168.132.48:6832/8761 conn(0x55aa02e39000 :6818 s=STATE_ACCEPTING_WAIT_CONNECT_MSG_AUTH pgs=0 cs=0 l=0).handle_connect_msg accept connect_seq 33 vs existing csq=33 existing_state=STATE_STANDBY
+2017-11-23 06:29:44.953383 7ff2b0f5b700  0 -- 192.168.132.30:6818/6907 >> 192.168.132.48:6832/8761 conn(0x55aa02e39000 :6818 s=STATE_ACCEPTING_WAIT_CONNECT_MSG_AUTH pgs=0 cs=0 l=0).handle_connect_msg accept connect_seq 34 vs existing csq=33 existing_state=STATE_STANDBY
diff --git a/tests/internal/data/config_format/convert/parsers_extra.chefclient.test b/tests/internal/data/config_format/convert/parsers_extra.chefclient.test
new file mode 100644
index 00000000000..a985043ac24
--- /dev/null
+++ b/tests/internal/data/config_format/convert/parsers_extra.chefclient.test
@@ -0,0 +1,30 @@
+[2017-10-26T11:11:37+00:00] INFO: Processing directory[/var/lib/nova/instances] action create (nfs-client::default line 147)
+[2017-10-26T11:11:37+00:00] INFO: directory[/var/lib/nova/instances] created directory /var/lib/nova/instances
+[2017-10-26T11:11:37+00:00] INFO: directory[/var/lib/nova/instances] owner changed to 0
+[2017-10-26T11:11:37+00:00] INFO: directory[/var/lib/nova/instances] group changed to 0
+[2017-10-26T11:11:37+00:00] INFO: directory[/var/lib/nova/instances] mode changed to 755
+[2017-10-26T11:11:37+00:00] INFO: Processing mount[Configuring mount: 192.168.131.243:/nova_nfs__vol_1/nova_1 -> /var/lib/nova/instances] action mount (nfs-client::default line 168)
+================================================================================
+Error executing action `mount` on resource 'mount[Configuring mount: 192.1.1.243:/nova_nfs_rot_2vol_1/nova_1 -> /var/lib/nova/instances]'
+================================================================================
+Mixlib::ShellOut::ShellCommandFailed
+------------------------------------
+Expected process to exit with [0], but received '32'
+---- Begin output of mount -t nfs -o vers=3,sec=sys,nofail,comment="managed-by-crowbar-barclamp-nfs-client" 192.18.11.243:/nova_nfs_vol_1/nova_1 /var/lib/nova/instances ----
+STDOUT:
+STDERR: mount.nfs: Connection timed out
+---- End output of mount -t nfs -o vers=3,sec=sys,nofail,comment="managed-by-crowbar-barclamp-nfs-client" 192.168.1.243:/nova_nfs_vol_1/nova_1 /var/lib/nova/instances ----
+Ran mount -t nfs -o vers=3,sec=sys,nofail,comment="managed-by-crowbar-barclamp-nfs-client" 192.16.1.243:/nova_nfs_rot_2_1_vsos211_vol_1/nova_1 /var/lib/nova/instances returned 32
+Resource Declaration:
+---------------------
+# In /var/chef/cache/cookbooks/nfs-client/recipes/default.rb
+168:   mount "Configuring mount: #{nfs_mount} -> #{mount_path}" do
+169:     mount_point mount_path
+170:     device nfs_mount
+171:     fstype "nfs"
+172:     options options
+173:     dump 0
+174:     pass 0
+175:     action [:mount, :enable]
+176:   end
+177: end
diff --git a/tests/internal/data/config_format/convert/parsers_extra.couchbase_java_multiline.test b/tests/internal/data/config_format/convert/parsers_extra.couchbase_java_multiline.test
new file mode 100644
index 00000000000..e9fb0552ae0
--- /dev/null
+++ b/tests/internal/data/config_format/convert/parsers_extra.couchbase_java_multiline.test
@@ -0,0 +1,11 @@
+2021-03-09T17:32:25.339+00:00 INFO CBAS.bootstrap.AnalyticsNCApplication [main] Starting Couchbase Analytics driver, version: {"build.date":"Thu Aug 06 20:37:33 UTC 2020","build.number":"7909","build.version":"6.6.0-7909"}
+2021-03-09T17:32:25.520+00:00 DEBU CBAS.util.MXHelper [main] ignoring exception calling RuntimeMXBean.getBootClassPath; returning null
+java.lang.UnsupportedOperationException: Boot class path mechanism is not supported
+	at sun.management.RuntimeImpl.getBootClassPath(Unknown Source) ~[?:?]
+	at org.apache.hyracks.util.MXHelper.getBootClassPath(MXHelper.java:111) [hyracks-util.jar:6.6.0-7909]
+	at org.apache.hyracks.control.common.controllers.NodeRegistration.<init>(NodeRegistration.java:110) [hyracks-control-common.jar:6.6.0-7909]
+	at org.apache.hyracks.control.nc.NodeControllerService.initNodeControllerState(NodeControllerService.java:334) [hyracks-control-nc.jar:6.6.0-7909]
+	at org.apache.hyracks.control.nc.NodeControllerService.start(NodeControllerService.java:299) [hyracks-control-nc.jar:6.6.0-7909]
+	at com.couchbase.analytics.control.AnalyticsDriver.startService(AnalyticsDriver.java:128) [cbas-server.jar:6.6.0-7909]
+	at com.couchbase.analytics.control.AnalyticsDriver.main(AnalyticsDriver.java:99) [cbas-server.jar:6.6.0-7909]
+2021-03-09T17:32:25.595+00:00 DEBU CBAS.work.WorkQueue [Worker:ClusterController] Executing: RegisterNode
diff --git a/tests/internal/data/config_format/convert/parsers_extra.couchbase_simple_log_mixed.test b/tests/internal/data/config_format/convert/parsers_extra.couchbase_simple_log_mixed.test
new file mode 100644
index 00000000000..1e80e16e9dc
--- /dev/null
+++ b/tests/internal/data/config_format/convert/parsers_extra.couchbase_simple_log_mixed.test
@@ -0,0 +1,3 @@
+2021/03/09 17:32:15 cbauth: key: fts/remoteClients registered for tls config updates
+2021-03-09T17:32:15.303+00:00 [INFO] main: /opt/couchbase/bin/cbft started (v0.6.0/5.5.0)
+2021-03-09T17:32:15.304+00:00 [INFO] main: file descriptor limit current: 1048576 max: 1048576
diff --git a/tests/internal/data/config_format/convert/parsers_extra.couchbase_simple_log_utc.test b/tests/internal/data/config_format/convert/parsers_extra.couchbase_simple_log_utc.test
new file mode 100644
index 00000000000..09fbe47c490
--- /dev/null
+++ b/tests/internal/data/config_format/convert/parsers_extra.couchbase_simple_log_utc.test
@@ -0,0 +1,5 @@
+2021-03-09T17:32:02.137Z INFO GOXDCR.TpThrottler:  update routine starting
+2021-03-09T17:32:02.137Z INFO GOXDCR.GlobalSettingChangeListener: Started MetakvChangeListener GlobalSettingChangeListener
+2021-03-09T17:32:02.137Z INFO GOXDCR.ResourceMgr: collectCpuUsage starting ....
+
+2021-03-09T17:32:02.137Z INFO GOXDCR.ResourceMgr: manageResources starting ....
diff --git a/tests/internal/data/config_format/convert/parsers_extra.crowbar.test b/tests/internal/data/config_format/convert/parsers_extra.crowbar.test
new file mode 100644
index 00000000000..d561aad2753
--- /dev/null
+++ b/tests/internal/data/config_format/convert/parsers_extra.crowbar.test
@@ -0,0 +1,20 @@
+D, [2017-11-23T08:50:11.027720 #22864:0x007f3714418208] DEBUG -- Backing up databag repos-suse-12_2-x86_64/sle-module-adv-systems-mgmt-pool
+D, [2017-11-23T08:50:11.042078 #22864:0x007f3714418208] DEBUG -- Backing up databag repos-suse-12_2-x86_64/sles12-sp2-pool
+D, [2017-11-23T08:50:11.061805 #22864:0x007f3714418208] DEBUG -- Backing up databag repos-suse-12_2-x86_64/sle12-sp2-ha-pool
+D, [2017-11-23T08:50:11.079647 #22864:0x007f3714418208] DEBUG -- Backing up database
+D, [2017-11-23T08:50:11.108171 #22864:0x007f3714418208] DEBUG -- Backing up Crowbar files
+cp: cannot create directory '/opt/dell/crowbar_framework/tmp/create_archive-20171123-22864-flw32o/crowbar/data/backup': No such file or directory
+cp: cannot create directory '/opt/dell/crowbar_framework/tmp/create_archive-20171123-22864-flw32o/crowbar/data/cache': No such file or directory
+cp: cannot create directory '/opt/dell/crowbar_framework/tmp/create_archive-20171123-22864-flw32o/crowbar/data/config': No such file or directory
+D, [2017-11-23T08:50:12.057969 #22864:0x007f3714418208] DEBUG -- Backing up batch export
+D, [2017-11-23T08:50:12.077959 #22864:0x007f3714418208] DEBUG --   Proposal Load (0.5ms)  SELECT "proposals".* FROM "proposals" WHERE "proposals"."barclamp" = $1  [["barclamp", "crowbar"]]
+W, [2017-11-23T08:50:12.106486 #23764:0x007f3702cefa78]  WARN -- Switch name Error: d9c-dc-71-4c-5d-f8.200.xxx.corp: Switch config not detected during discovery
+W, [2017-11-23T08:50:12.114466 #23764:0x007f3702cefa78]  WARN -- Switch name Error: d9c-dc-71-4c-ba-f8.200.xxx.corp: Switch config not detected during discovery
+W, [2017-11-23T08:50:12.119009 #23764:0x007f3702cefa78]  WARN -- Switch name Error: d9c-dc-71-4c-f2-d0.200.xxx.corp: Switch config not detected during discovery
+W, [2017-11-23T08:50:12.136668 #23764:0x007f3702cefa78]  WARN -- Switch name Error: de0-07-1b-67-14-08.200.xxx.corp: Switch config not detected during discovery
+I, [2017-11-23T08:50:12.147477 #23764:0x007f3702cefa78]  INFO -- Completed 200 OK in 6024ms (Views: 5.8ms | ActiveRecord: 0.0ms)
+I, [2017-11-23T08:50:12.778818 #23764:0x007f3703f17598]  INFO -- Started GET "/crowbar/machines/1.0/show?name=d9c-dc-71-4c-f2-d0.200.xxx.corp" for 127.0.0.1 at 2017-11-23 08:50:12 +0000
+I, [2017-11-23T08:50:12.782483 #23764:0x007f3703f17598]  INFO -- Processing by MachinesController#show as JSON
+I, [2017-11-23T08:50:12.782614 #23764:0x007f3703f17598]  INFO --   Parameters: {"name"=>"d9c-dc-71-4c-f2-d0.200.xxx.corp", "id"=>"show"}
+I, [2017-11-23T08:50:12.846419 #23764:0x007f3703f17598]  INFO -- Completed 200 OK in 64ms (Views: 12.2ms | ActiveRecord: 0.0ms)
+I, [2017-11-23T08:50:13.137919 #23764:0x007f3703f17598]  INFO -- Started GET "/crowbar/machines/1.0/show?name=d9c-dc-71-4c-ba-f8.200.xxx.corp" for 127.0.0.1 at 2017-11-23 08:50:13 +0000
diff --git a/tests/internal/data/config_format/convert/run_tests.sh b/tests/internal/data/config_format/convert/run_tests.sh
new file mode 100755
index 00000000000..8b221e1ea63
--- /dev/null
+++ b/tests/internal/data/config_format/convert/run_tests.sh
@@ -0,0 +1,100 @@
+#!/bin/bash
+
+# Test a batch of parsers that have been converted from .conf to .yaml,
+# to make sure they produce the same results (for each parser that provides
+# test-case sample logs).
+
+warn()
+{
+  echo "$@" >&2
+}
+
+die()
+{
+  warn "$@"
+  exit 1
+}
+
+# Parsers that do not extract a date and use it will fall back to
+# current time for date - changing from one run to the next.
+# We have no choice but to squash well-formed date fields.
+# N.B.: requires sed -E support - GNU or BSD sed
+squash_date()
+{
+  ##"date":1763275639.56544,
+  ##"date":1763275640.571014,
+  sed -E 's/"date":[0-9]+\.[0-9]+,/"date":1234567890.123456,/'
+}
+
+# Unless in verbose mode, flatten each output to a checksum of itself
+filter()
+{
+  squash_date | sha256sum | cut -d\  -f1
+}
+
+usage()
+{
+  die "Usage: $0 [-v] [file1.test [file2.test ...]]
+
+  Process parser*.*.test files, either each one named on the command line,
+  or every file in pwd matching that pattern.
+
+  Makes sure the output produced by the .conf file and .yaml configs match.
+
+  Needs a corresponding .conf and .yaml for each.
+"
+}
+
+# Empty output (or a hash of an empty string) is a sure sign of failure
+check_output()
+{
+  local check="$1"
+  [[ "$check" = "" ]] || \
+  [[ "$check" = "01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b" ]] || \
+  [[ "$check" = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" ]] && \
+	echo -e "\n" && die "### FAIL '$TEST_FILE' output was empty"
+}
+
+TEST_FILES=()
+
+for arg in "$@"; do
+  case "$arg" in
+    -v) filter() { squash_date; }; ;;
+    -*) usage ;;
+    *)  TEST_FILES+=("$arg") ;;
+  esac
+done
+
+# Make sure we have fluent-bit and confirm basic functionality
+command -v fluent-bit >/dev/null 2>&1 || die "fluent-bit not found in PATH"
+if ! echo '{"a":"b"}' | fluent-bit -q -i stdin -o stdout -p format=json_lines | grep -E -q '{"date":[0-9]+\.[0-9]+,"a":"b"}' ; then
+  die "fluent-bit self-test failed, cannot continue."
+fi
+
+# If not provided any filenames, process all that match
+[[ ${#TEST_FILES[@]} -eq 0 ]] && TEST_FILES=(parser*.*.test)
+
+for TEST_FILE in "${TEST_FILES[@]}" ; do
+  [[ $TEST_FILE =~ ^([^.]*)\.([^.]+)\.[^.]+$ ]] || \
+	{ warn "'${TEST_FILE}': must contain three dot-separated tokens, skipping."; continue; }
+  PARSER_FILE="${BASH_REMATCH[1]}"
+  PARSER_NAME="${BASH_REMATCH[2]}"
+
+  echo "### '$TEST_FILE'"
+  [[ -e ${PARSER_FILE}.conf ]] || { warn "'${TEST_FILE}': legacy '${PARSER_FILE}.conf' not found, skipping"; continue; }
+  [[ -e ${PARSER_FILE}.yaml ]] || { warn "'${TEST_FILE}': new '${PARSER_FILE}.yaml' not found, skipping"; continue; }
+  echo -n "CONF: ";
+  CONF_OUT="$(cat "$TEST_FILE" | fluent-bit -q -R "${PARSER_FILE}".conf -i stdin -p parser="${PARSER_NAME}" -o stdout -p format=json_lines | filter)"
+  check_output "$CONF_OUT"
+  echo "$CONF_OUT"
+  echo -n "YAML: ";
+  YAML_OUT="$(cat "$TEST_FILE" | fluent-bit -q -R "${PARSER_FILE}".yaml -i stdin -p parser="${PARSER_NAME}" -o stdout -p format=json_lines | filter)"
+  check_output "$YAML_OUT"
+  echo "$YAML_OUT"
+  if [[ "$CONF_OUT" == "$YAML_OUT" ]]; then
+    echo "### OK '$TEST_FILE'"
+  else
+    die "### FAIL '$TEST_FILE'"
+  fi
+  echo
+done

From 85e1cccc743557241690e63ad5aa7d25314936ff Mon Sep 17 00:00:00 2001
From: Hank Leininger <hlein@korelogic.com>
Date: Sun, 16 Nov 2025 00:29:04 -0700
Subject: [PATCH 5/7] conf: parser: Add YAML versions of all existing
 conf/parser*conf files

These have been run through the test suite to make sure fluent-bit
produces identical output using them.

Signed-off-by: Hank Leininger <hlein@korelogic.com>
---
 conf/parser_custom.yaml      |  15 ++++
 conf/parsers.yaml            | 122 +++++++++++++++++++++++++++
 conf/parsers_ambassador.yaml |   7 ++
 conf/parsers_cinder.yaml     |   8 ++
 conf/parsers_extra.yaml      | 159 +++++++++++++++++++++++++++++++++++
 conf/parsers_java.yaml       |   6 ++
 conf/parsers_kafka.yaml      |  14 +++
 conf/parsers_mult.yaml       |  22 +++++
 conf/parsers_multiline.yaml  |  12 +++
 conf/parsers_openstack.yaml  |  49 +++++++++++
 10 files changed, 414 insertions(+)
 create mode 100644 conf/parser_custom.yaml
 create mode 100644 conf/parsers.yaml
 create mode 100644 conf/parsers_ambassador.yaml
 create mode 100644 conf/parsers_cinder.yaml
 create mode 100644 conf/parsers_extra.yaml
 create mode 100644 conf/parsers_java.yaml
 create mode 100644 conf/parsers_kafka.yaml
 create mode 100644 conf/parsers_mult.yaml
 create mode 100644 conf/parsers_multiline.yaml
 create mode 100644 conf/parsers_openstack.yaml

diff --git a/conf/parser_custom.yaml b/conf/parser_custom.yaml
new file mode 100644
index 00000000000..15af99427a2
--- /dev/null
+++ b/conf/parser_custom.yaml
@@ -0,0 +1,15 @@
+parsers:
+  - name: rabbitmq
+    # https://rubular.com/r/6ZCuwV4Xa7nfA3
+    format: regex
+    regex: (?<date>[^ ]+)\s(?<time>[^ ]+)\s\[(?<log_level>[^ \]]*)\]\s(?<PID>[^ ]*)\s(?<msg>((([a-zA-Z]*\s+)+[^ ]*)+)+)
+
+  - name: neo4j
+    # https://rubular.com/r/jWfJIOMKr2LgcO
+    format: regex
+    regex: (?<date>[^ ]*) (?<time>[^ ]*) (?<log_level>[^ ]*)\s(?<msg>([^ ]*\s+[^ ]*)+)
+
+  - name: external-dns
+    # https://rubular.com/r/U8VbByp0oRPLU6
+    format: regex
+    regex: ([^ ])\"(?<time>[^ ]+)\"\s([^ ]+)\=(?<log_level>[.+a-zA-Z]+)\s([^ ]+)\"(?<msg>([^ ]*\s+[^ ]*\s[a-zA-Z0-9]*)+)
diff --git a/conf/parsers.yaml b/conf/parsers.yaml
new file mode 100644
index 00000000000..6a4a14a8e0d
--- /dev/null
+++ b/conf/parsers.yaml
@@ -0,0 +1,122 @@
+parsers:
+  - name: apache
+    format: regex
+    regex: '^(?<host>[^ ]*) [^ ]* (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*?)(?: +\S*)?)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)")?$'
+    time_key: time
+    time_format: '%d/%b/%Y:%H:%M:%S %z'
+
+  - name: apache2
+    format: regex
+    regex: '^(?<host>[^ ]*) [^ ]* (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^ ]*) +\S*)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>.*)")?$'
+    time_key: time
+    time_format: '%d/%b/%Y:%H:%M:%S %z'
+
+  - name: apache_error
+    format: regex
+    regex: '^\[[^ ]* (?<time>[^\]]*)\] \[(?<level>[^\]]*)\](?: \[pid (?<pid>[^\]]*)\])?( \[client (?<client>[^\]]*)\])? (?<message>.*)$'
+
+  - name: nginx
+    format: regex
+    regex: '^(?<remote>[^ ]*) (?<host>[^ ]*) (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*?)(?: +\S*)?)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)")'
+    time_key: time
+    time_format: '%d/%b/%Y:%H:%M:%S %z'
+
+  - name: k8s-nginx-ingress
+    # https://rubular.com/r/IhIbCAIs7ImOkc
+    format: regex
+    regex: '^(?<host>[^ ]*) - (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*?)(?: +\S*)?)?" (?<code>[^ ]*) (?<size>[^ ]*) "(?<referer>[^\"]*)" "(?<agent>[^\"]*)" (?<request_length>[^ ]*) (?<request_time>[^ ]*) \[(?<proxy_upstream_name>[^ ]*)\] (\[(?<proxy_alternative_upstream_name>[^ ]*)\] )?(?<upstream_addr>[^ ]*) (?<upstream_response_length>[^ ]*) (?<upstream_response_time>[^ ]*) (?<upstream_status>[^ ]*) (?<reg_id>[^ ]*).*$'
+    time_key: time
+    time_format: '%d/%b/%Y:%H:%M:%S %z'
+
+  - name: json
+    format: json
+    time_key: time
+    time_format: '%d/%b/%Y:%H:%M:%S %z'
+
+  - name: logfmt
+    format: logfmt
+
+  - name: docker
+    format: json
+    time_key: time
+    time_format: '%Y-%m-%dT%H:%M:%S.%L'
+    time_keep: On
+    # --
+    # Since Fluent Bit v1.2, if you are parsing Docker logs and using
+    # the Kubernetes filter, it's not longer required to decode the
+    # 'log' key.
+    #
+    # Command      |  Decoder | Field | Optional Action
+    # =============|==================|=================
+    #Decode_Field_As    json     log
+    #
+
+  - name: docker-daemon
+    format: regex
+    regex: time="(?<time>[^ ]*)" level=(?<level>[^ ]*) msg="(?<msg>[^ ].*)"
+    time_key: time
+    time_format: '%Y-%m-%dT%H:%M:%S.%L'
+    time_keep: On
+
+  - name: syslog-rfc5424
+    format: regex
+    regex: ^\<(?<pri>[0-9]{1,5})\>1 (?<time>[^ ]+) (?<host>[^ ]+) (?<ident>[^ ]+) (?<pid>[-0-9]+) (?<msgid>[^ ]+) (?<extradata>(\[(.*?)\]|-)) (?<message>.+)$
+    time_key: time
+    time_format: '%Y-%m-%dT%H:%M:%S.%L%z'
+    time_keep: On
+
+  - name: syslog-rfc3164-local
+    format: regex
+    regex: '^\<(?<pri>[0-9]+)\>(?<time>[^ ]* {1,2}[^ ]* [^ ]*) (?<ident>[a-zA-Z0-9_\/\.\-]*)(?:\[(?<pid>[0-9]+)\])?(?:[^\:]*\:)? *(?<message>.*)$'
+    time_key: time
+    time_format: '%b %d %H:%M:%S'
+    time_keep: On
+
+  - name: syslog-rfc3164
+    format: regex
+    regex: '/^\<(?<pri>[0-9]+)\>(?<time>[^ ]* {1,2}[^ ]* [^ ]*) (?<host>[^ ]*) (?<ident>[a-zA-Z0-9_\/\.\-]*)(?:\[(?<pid>[0-9]+)\])?(?:[^\:]*\:)? *(?<message>.*)$/'
+    time_key: time
+    time_format: '%b %d %H:%M:%S'
+    time_keep: On
+
+  - name: mongodb
+    format: regex
+    regex: '^(?<time>[^ ]*)\s+(?<severity>\w)\s+(?<component>[^ ]+)\s+\[(?<context>[^\]]+)]\s+(?<message>.*?) *(?<ms>(\d+))?(:?ms)?$'
+    time_format: '%Y-%m-%dT%H:%M:%S.%L'
+    time_keep: On
+    time_key: time
+
+  - name: envoy
+    # https://rubular.com/r/0VZmcYcLWMGAp1
+    format: regex
+    regex: '^\[(?<start_time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*?)(?: +\S*)?)? (?<protocol>\S+)" (?<code>[^ ]*) (?<response_flags>[^ ]*) (?<bytes_received>[^ ]*) (?<bytes_sent>[^ ]*) (?<duration>[^ ]*) (?<x_envoy_upstream_service_time>[^ ]*) "(?<x_forwarded_for>[^ ]*)" "(?<user_agent>[^\"]*)" "(?<request_id>[^\"]*)" "(?<authority>[^ ]*)" "(?<upstream_host>[^ ]*)"'
+    time_format: '%Y-%m-%dT%H:%M:%S.%L%z'
+    time_keep: On
+    time_key: start_time
+
+  - name: istio-envoy-proxy
+    # https://rubular.com/r/hbsTIxFFMozLmh
+    format: regex
+    regex: '^\[(?<start_time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*?)(?: +\S*)?)? (?<protocol>\S+)" (?<response_code>[^ ]*) (?<response_flags>[^ ]*) (?<response_code_details>[^ ]*) (?<connection_termination_details>[^ ]*) "(?<upstream_transport_failure_reason>[^ ]*)" (?<bytes_received>[^ ]*) (?<bytes_sent>[^ ]*) (?<duration>[^ ]*) (?<x_envoy_upstream_service_time>[^ ]*) "(?<x_forwarded_for>[^ ]*)" "(?<user_agent>[^\"]*)" "(?<x_request_id>[^\"]*)" "(?<authority>[^ ]*)" "(?<upstream_host>[^ ]*)" (?<upstream_cluster>[^ ]*) (?<upstream_local_address>[^ ]*) (?<downstream_local_address>[^ ]*) (?<downstream_remote_address>[^ ]*) (?<requested_server_name>[^ ]*) (?<route_name>[^  ]*)$'
+    time_format: '%Y-%m-%dT%H:%M:%S.%L%z'
+    time_keep: On
+    time_key: start_time
+
+  - name: cri
+    # https://rubular.com/r/tjUt3Awgg4
+    format: regex
+    regex: ^(?<time>[^ ]+) (?<stream>stdout|stderr) (?<logtag>[^ ]*) (?<message>.*)$
+    time_key: time
+    time_format: '%Y-%m-%dT%H:%M:%S.%L%z'
+    time_keep: On
+
+  - name: kube-custom
+    format: regex
+    regex: '(?<tag>[^.]+)?\.?(?<pod_name>[a-z0-9](?:[-a-z0-9]*[a-z0-9])?(?:\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*)_(?<namespace_name>[^_]+)_(?<container_name>.+)-(?<docker_id>[a-z0-9]{64})\.log$'
+
+  - name: kmsg-netfilter-log
+    # Examples: TCP: https://rubular.com/r/Q8YY6fHqlqwGI0  UDP: https://rubular.com/r/B0ID69H9FvN0tp
+    format: regex
+    regex: '^\<(?<pri>[0-9]{1,5})\>1 (?<time>[^ ]+) (?<host>[^ ]+) kernel - - - \[[0-9\.]*\] (?<logprefix>[^ ]*)\s?IN=(?<in>[^ ]*) OUT=(?<out>[^ ]*) MAC=(?<macsrc>[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}):(?<macdst>[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}:[0-9a-f]{2}):(?<ethtype>[0-9a-f]{2}:[0-9a-f]{2}) SRC=(?<saddr>[^ ]*) DST=(?<daddr>[^ ]*) LEN=(?<len>[^ ]*) TOS=(?<tos>[^ ]*) PREC=(?<prec>[^ ]*) TTL=(?<ttl>[^ ]*) ID=(?<id>[^ ]*) (D*F*)\s*PROTO=(?<proto>[^ ]*)\s?((SPT=)?(?<sport>[0-9]*))\s?((DPT=)?(?<dport>[0-9]*))\s?((LEN=)?(?<protolen>[0-9]*))\s?((WINDOW=)?(?<window>[0-9]*))\s?((RES=)?(?<res>0?x?[0-9]*))\s?(?<flag>[^ ]*)\s?((URGP=)?(?<urgp>[0-9]*))'
+    time_key: time
+    time_format: '%Y-%m-%dT%H:%M:%S.%L%z'
diff --git a/conf/parsers_ambassador.yaml b/conf/parsers_ambassador.yaml
new file mode 100644
index 00000000000..456fd6511cf
--- /dev/null
+++ b/conf/parsers_ambassador.yaml
@@ -0,0 +1,7 @@
+# Ambassador - open source Kubernetes-native API gateway for microservices built on the Envoy Proxy https://www.getambassador.io
+#
+
+parsers:
+  - name: ambassador
+    format: regex
+    regex: '^(?<type>\S+) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>(?:[^\"]|\\.)*?)(?: +\S*)?) (?<protocol>\S+)?" (?<response_code>\S+) (?<response_flags>\S+) (?<bytes_received>\S+) (?<bytes_sent>\S+) (?<duration>\S+) (?<x_envoy_upstream_service_time>\S+) "(?<x_forwarded_for>[^\"]*)" "(?<user_agent>[^\"]*)" "(?<x_request_id>[^\"]*)" "(?<authority>[^\"]*)" "(?<upstream_host>[^\"]*)"'
diff --git a/conf/parsers_cinder.yaml b/conf/parsers_cinder.yaml
new file mode 100644
index 00000000000..278e3263ee7
--- /dev/null
+++ b/conf/parsers_cinder.yaml
@@ -0,0 +1,8 @@
+parsers:
+  - name: ceph
+    # https://rubular.com/r/IvZVElTgNl
+    format: regex
+    regex: '^(?<log_time>[^ ][-.\d\+:T]+[ ]*[.:\d]*)\s+(?<message>.*)$'
+    time_format: '%Y-%m-%d %H:%M:%S.%L'
+    time_keep: Off
+    time_key: log_time
diff --git a/conf/parsers_extra.yaml b/conf/parsers_extra.yaml
new file mode 100644
index 00000000000..c3c294f68b1
--- /dev/null
+++ b/conf/parsers_extra.yaml
@@ -0,0 +1,159 @@
+# Extra set of common parsers
+#
+
+parsers:
+  - name: crowbar
+    # https://rubular.com/r/cCVd1HLCAO
+    format: regex
+    regex: '^.*\[(?<log_time>[^ ][-.\d\+:]+T[:\d]*)([^\]])*?\]\s+?(?<severity>[^ ]\w+)([\s-]*):?\s+(?<message>.*)'
+    time_format: '%Y-%m-%dT%H:%M:%S'
+    time_keep: Off
+    time_key: log_time
+
+  - name: chefclient
+    # https://rubular.com/r/frDgnElXW9
+    format: regex
+    regex: '^\[(?<log_time>[^ ][-.\d\+:]+T[:\d]*)([^\]])*?\]\s+(?<severity>[^ ]\w+):\s+(?<message>.*)$'
+    time_format: '%Y-%m-%dT%H:%M:%S'
+    time_keep: Off
+    time_key: log_time
+
+  - name: mysql_error
+    format: regex
+    #regex: '^(?<log_time>[^ +][ -:0-9TZ]+|[[:upper:]][[:lower:]]{2})(\+\d+:\d+[TZ]*){0,1}\s*(?<myid>[^ ]\d+)\s+\[(?<severity>[^ ]\w+)\](\s+(?<subsystem>[^ ]\w+):){0,1}\s+(?<message>.*)$'
+    regex: '^(?<log_time>[^ +][-\d]+[\ T]*[:\dZ]+)\s*(?<myid>[^ ]\d+)\s+\[(?<severity>[^ ]\w+)\](\s+(?<subsystem>[^ ]\w+):){0,1}\s+(?<message>.*)$'
+    time_format: '%Y-%m-%d %H:%M:%S'
+    time_keep: Off
+    time_key: log_time
+
+  - name: mysql_slow
+    format: regex
+    regex: '^# User\@Host:\s+(?<user>[^\@][\w\[\]]+)[@\s]+(?<dbhost>[^ ][-.\w]+)\s+(\[(?<dbhost_address>[.\d]+)\]){0,1}\s+(?<message>.*)$'
+
+  - name: pacemaker
+    format: regex
+    regex: '^\s*(?<log_time>[^ ]* {1,2}[^ ]* [^ ]*) \[(?<pid>\d+)\] (?<node>[\-\w]*)\s*(?<component>\w*):\s+(?<severity>\w+):\s+(?<message>.*)$'
+    #time_format: '%Y-%m-%dT%H:%M:%S'
+    time_format: '%b %d %H:%M:%S'
+    time_keep: Off
+    time_key: log_time
+    #types: 'pid:integer'
+    #
+
+  - name: rabbitmq
+    format: regex
+    regex: '^=(?<severity>[^ ]\w+)\s+REPORT[=\s]*(?<log_time>[^ =][-:.\d\w]+)[\s=]+(?<message>.*)$'
+    time_format: '%d-%b-%Y::%H:%M:%S'
+    time_keep: Off
+    time_key: log_time
+
+  - name: http_statement
+    format: regex
+    regex: '^.*((?<req_method>GET|POST|PUT|DELETE|CONNECT|OPTIONS|HEAD[^ ]\w+)\s*(?<req_path>[^ ][-._?=%&\/[:alnum:]]*)\s*(?<req_protocol>[^ ][.\/\dHTFSP]+){0,1})([''"\s]*){0,1}((\s*status:\s*(?<req_status>[^ ]\d+)){0,1}(\s*len:\ (?<req_len>[^ ]\d+)){0,1}(\s*time:\s*(?<req_log_time>[^ ][.\d]+)){0,1}(\s*microversion:\s*(?<req_mver>[^ ][.\d]+)){0,1}){0,1}$'
+
+  - name: universal
+    format: regex
+    regex: ^(?<message>.*)$
+
+  - name: uuid
+    format: regex
+    regex: (?<uuid>[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})
+    #UUID v1 :
+    #/^[0-9A-F]{8}-[0-9A-F]{4}-[1][0-9A-F]{3}-[89AB][0-9A-F]{3}-[0-9A-F]{12}$/i
+    #UUID v2 :
+    #/^[0-9A-F]{8}-[0-9A-F]{4}-[2][0-9A-F]{3}-[89AB][0-9A-F]{3}-[0-9A-F]{12}$/i
+    #UUID v3 :
+    #/^[0-9A-F]{8}-[0-9A-F]{4}-[3][0-9A-F]{3}-[89AB][0-9A-F]{3}-[0-9A-F]{12}$/i
+    #UUID v4 :
+    #/^[0-9A-F]{8}-[0-9A-F]{4}-[4][0-9A-F]{3}-[89AB][0-9A-F]{3}-[0-9A-F]{12}$/i
+    #UUID v5 :
+    #/^[0-9A-F]{8}-[0-9A-F]{4}-[5][0-9A-F]{3}-[89AB][0-9A-F]{3}-[0-9A-F]{12}$/i
+    #
+    # Parse IP Tables rules - this one regex should capture pretty much any IP Tables rule and split it into the various fields
+
+  - name: iptables
+    format: regex
+    regex: '\[(?<rule_chain>\w*)-(?<rule_name>\w*)-(?<accept_or_drop>\w*)\]IN=(?<in_interface>[\w.]+)? OUT=(?<out_interface>[\w.]+)? MAC=(?<mac_address>[\w:]+)? SRC=(?<source>(?:[0-9]{1,3}\.){3}[0-9]{1,3}) DST=(?<dest>(?:[0-9]{1,3}\.){3}[0-9]{1,3}) LEN=(?<pkt_len>\d+) TOS=(?<pkt_tos>[\w\d]+) PREC=(?<pkt_prec>[\w\d]+) TTL=(?<pkt_ttl>\d+) ID=(?<pkt_id>\d+)\s?(?<pkg_frg>[A-Z\s].?)\s?PROTO=(?<protocol>[\w\d]+) (SPT=(?<source_port>.*) DPT=(?<dest_port>.*) (LEN=(?<proto_pkt_len>\w+)?)?(WINDOW=(?<proto_window_size>\d+) RES=(?<pkt_res>\w+)? (?<pkt_type>\w+)\s((?<pkt_flag>\w+)?)\s?URGP=(?<pkg_urgency>\d))? )?(TYPE=(?<pkt_icmp_type>\d+) CODE=(?<pkt_icmp_code>\d+) ID=(?<pkt_icmp_id>\d+) SEQ=(?<pkt_icmp_seq>\d+) )?$'
+    types: 'source_port:integer,dest_port:integer,pkt_ttl:integer,pkt_tos:integer,pkt_len:integer'
+
+  - name: couchbase_json_log_nanoseconds
+    # Various parsers for Couchbase Server logs
+    #
+    format: json
+    time_key: timestamp
+    time_format: '%Y-%m-%dT%H:%M:%S.%L'
+    time_keep: On
+    # Do not remove the time field from the output we ship
+    #
+
+  - name: couchbase_rebalance_report
+    format: json
+    time_key: timestamp
+    time_format: '%Y-%m-%dT%H:%M:%SZ'
+    time_keep: On
+
+  - name: couchbase_simple_log
+    # The level may have optional brackets around it
+    format: regex
+    regex: '^(?<timestamp>\d+-\d+-\d+T\d+:\d+:\d+\.\d+(\+|-)\d+:\d+)\s+\[(?<level>\w+)\](?<message>.*)$'
+    time_key: timestamp
+    time_format: '%Y-%m-%dT%H:%M:%S.%L%z'
+    time_keep: On
+
+  - name: couchbase_simple_log_space_separated
+    format: regex
+    regex: '^(?<timestamp>\d+-\d+-\d+T\d+:\d+:\d+\.\d+(\+|-)\d+:\d+)\s+(?<level>\w+)\s+(?<message>.*)$'
+    time_key: timestamp
+    time_format: '%Y-%m-%dT%H:%M:%S.%L%z'
+    time_keep: On
+
+  - name: couchbase_simple_log_utc
+    # Slight change in time format to use Z at end instead of offset:
+    # 2021-03-09T17:32:02.136Z INFO ...
+    # https://rubular.com/r/EpG3M1dHb5AnTC
+    format: regex
+    regex: '^(?<timestamp>\d+-\d+-\d+T\d+:\d+:\d+\.\d+Z)\s+(?<level>\w+)(?<message>.*)$'
+    time_key: timestamp
+    time_format: '%Y-%m-%dT%H:%M:%S.%LZ'
+    time_keep: On
+
+  - name: couchbase_simple_log_mixed
+    # Cope with two different log formats, e.g.:
+    # 2021/03/09 17:32:15 cbauth: ...
+    # 2021-03-09T17:32:15.303+00:00 [INFO] ...
+    # https://rubular.com/r/XUt7xQqEJnrF2M
+    format: regex
+    regex: '^(?<timestamp>\d+(-|/)\d+(-|/)\d+(T|\s+)\d+:\d+:\d+(\.\d+(\+|-)\d+:\d+|))\s+((\[)?(?<level>\w+)(\]|:))(?<message>.*)$'
+    time_key: timestamp
+    time_keep: On
+    # We cannot parse the time as different formats directly, it could be done downstream and/or left as current time
+    #
+
+  - name: couchbase_erlang_multiline
+    format: regex
+    # For some reason this cannot parse an ending close bracket ] followed by a new line immediately
+    #regex: '\[(?<logger>\w+):(?<level>\w+),(?<timestamp>\d+-\d+-\d+T\d+:\d+:\d+.\d+Z),.*\](?<message>.*)$'
+    regex: '\[(?<logger>\w+):(?<level>\w+),(?<timestamp>\d+-\d+-\d+T\d+:\d+:\d+.\d+Z),(?<message>.*)$'
+    time_key: timestamp
+    time_format: '%Y-%m-%dT%H:%M:%S.%L'
+    time_keep: On
+
+  - name: couchbase_java_multiline
+    # 2021-03-09T17:32:25.339+00:00 INFO CBAS.bootstrap.AnalyticsNCApplication [main] ...
+    # https://rubular.com/r/9jh1oKtXBN5GEV
+    # Can include an exception stack trace or a thread dump as well but ignoring these for now
+    format: regex
+    regex: '^(?<timestamp>\d+-\d+-\d+T\d+:\d+:\d+\.\d+(\+|-)\d+:\d+)\s+(?<level>\w+)\s+(?<class>.*)\s+\[(?<thread>.*)\]\s+(?<message>.*)$'
+    time_key: timestamp
+    time_format: '%Y-%m-%dT%H:%M:%S.%L%z'
+    time_keep: On
+
+  - name: couchbase_http
+    # A slight modification of the usual Apache/Apache2 parsers
+    format: regex
+    regex: '^(?<host>[^ ]*) [^ ]* (?<user>[^ ]*) \[(?<timestamp>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^ ]*) +\S*)?" (?<code>[^ ]*) (?<size>[^ ]*) - (?<client>.*)$'
+    time_key: timestamp
+    time_format: '%d/%b/%Y:%H:%M:%S %z'
+    time_keep: On
+
+# End of Couchbase Server parsers
diff --git a/conf/parsers_java.yaml b/conf/parsers_java.yaml
new file mode 100644
index 00000000000..e6b739c5c96
--- /dev/null
+++ b/conf/parsers_java.yaml
@@ -0,0 +1,6 @@
+parsers:
+  - name: java_multiline
+    format: regex
+    regex: '/^(?<time>\d{4}-\d{1,2}-\d{1,2} \d{1,2}:\d{1,2}:\d{1,2}) \[(?<thread>.*)\] (?<level>[^\s]+)(?<message>.*)/'
+    time_key: time
+    time_format: '%Y-%m-%d %H:%M:%S'
diff --git a/conf/parsers_kafka.yaml b/conf/parsers_kafka.yaml
new file mode 100644
index 00000000000..10e0641ec5f
--- /dev/null
+++ b/conf/parsers_kafka.yaml
@@ -0,0 +1,14 @@
+parsers:
+  - name: confluent-schema-registry
+    # Confluent Schema Registry 7.1.1 default format
+    format: regex
+    time_key: time
+    time_format: '%Y-%m-%d %H:%M:%S,%L'
+    regex: '^\[(?<time>\d{4}-\d{1,2}-\d{1,2} \d{2}:\d{2}:\d{2},\d{1,4})] (?<level>[A-Z]{1,8}) (?<src>[\d.]+) - - \[(?<date>.*)] \"(?<method>[A-Z]+) (?<path>\/[\S]+|\/) (?<http_version>HTTP\/[\d]\.[\d])\" (?<code>[\d]{1,3}) (?<size>[\d]+) \"-\" \"(?<agent>.*)\" (?<extra_info>.*)'
+
+  - name: confluent-schema-registry-prefixed
+    # Confluent Schema Registry 7.1.1 default format - with _sr_ prefix to allow `nest`
+    format: regex
+    time_key: _sr_time
+    time_format: '%Y-%m-%d %H:%M:%S,%L'
+    regex: '^\[(?<_sr_time>\d{4}-\d{1,2}-\d{1,2} \d{2}:\d{2}:\d{2},\d{1,4})] (?<_sr_level>[A-Z]{1,8}) (?<_sr_src>[\d.]+) - - \[(?<_sr_date>.*)] \"(?<_sr_method>[A-Z]+) (?<_sr_path>\/[\S]+|\/) (?<_sr_http_version>HTTP\/[\d]\.[\d])\" (?<_sr_code>[\d]{1,3}) (?<_sr_size>[\d]+) \"-\" \"(?<_sr_agent>.*)\" (?<_sr_extra_info>.*)'
diff --git a/conf/parsers_mult.yaml b/conf/parsers_mult.yaml
new file mode 100644
index 00000000000..34bc2c58350
--- /dev/null
+++ b/conf/parsers_mult.yaml
@@ -0,0 +1,22 @@
+parsers:
+  - name: mult_first
+    format: regex
+    regex: Started (?<method>[^ ]+) "(?<path>[^"]+)" for (?<host>[^ ]+) at (?<time>[^ ]+ [^ ]+ [^ ]+)
+    time_key: time
+    time_format: '%Y-%m-%d %H:%M:%S %z'
+
+  - name: mult_1
+    format: regex
+    regex: /Processing by (?<controller>[^\u0023]+)\u0023(?<controller_method>[^ ]+) as (?<format>[^ ]+?)$/
+
+  - name: mult_2
+    format: regex
+    regex: '(  Parameters: (?<parameters>[^ ]+))?'
+
+  - name: mult_3
+    format: regex
+    regex: /  Rendered (?<template>[^ ]+) within (?<layout>.+) \([\d\.]+ms\)/
+
+  - name: mult_4
+    format: regex
+    regex: 'Completed (?<code>[^ ]+) [^ ]+ in (?<runtime>[\d\.]+)ms \(Views: (?<view_runtime>[\d\.]+)ms \| ActiveRecord: (?<ar_runtime>[\d\.]+)ms\)'
diff --git a/conf/parsers_multiline.yaml b/conf/parsers_multiline.yaml
new file mode 100644
index 00000000000..2c7592e86fd
--- /dev/null
+++ b/conf/parsers_multiline.yaml
@@ -0,0 +1,12 @@
+multiline_parsers:
+  - name: exception_test
+    type: regex
+    flush_timeout: 1000
+    rules:
+      - state: start_state
+        regex: '/(Dec \d+ \d+\:\d+\:\d+)(.*)/'
+        next_state: cont
+
+      - state: cont
+        regex: /^\s+at.*/
+        next_state: cont
diff --git a/conf/parsers_openstack.yaml b/conf/parsers_openstack.yaml
new file mode 100644
index 00000000000..37e8c731874
--- /dev/null
+++ b/conf/parsers_openstack.yaml
@@ -0,0 +1,49 @@
+# Example openstack parsers, see source for recent updates:
+# https://github.com/salt-formulas/salt-formula-fluentbit/tree/master/metadata/service/config/parser
+#
+# Take these parsers as an example, as they may not fully fit all possible
+# openstack deployments from all vendors, etc..
+#
+
+parsers:
+  - name: cinder
+    format: regex
+    regex: '^(?<log_time>[^ ][-.\d\+:T]+[ ]*[.:\d]*)\s+(?<pid>[^ ]\d+)\s+(?<severity>[^ ][.-_\w]+)\s+(?<component>[^ ][.-_\w]+)(\s+\[(-|(?<req_id>[^ ][-\w]*) (?<req_user>[^ ][-\w]*) (?<req_project>[^ ][-\w]*) (?<req_domain>[^ ][-\w]*) (?<req_user_domain>[^ ][-\w]*) (?<req_project_domain>[^ ][-\w]*))\]){1}\s+(?<message>.*)$'
+    time_format: '%Y-%m-%d %H:%M:%S.%L'
+    time_keep: Off
+    time_key: log_time
+
+  - name: glance
+    format: regex
+    regex: '^(?<log_time>[^ ][-.\d\+:T]+[ ]*[.:\d]*)\s+(?<pid>[^ ]\d+)\s+(?<severity>[^ ][.-_\w]+)\s+(?<component>[^ ][.-_\w]+)(\s+\[(-|(?<req_id>[^ ][-\w]*) (?<req_user>[^ ][-\w]*) (?<req_project>[^ ][-\w]*) (?<req_domain>[^ ][-\w]*) (?<req_user_domain>[^ ][-\w]*) (?<req_project_domain>[^ ][-\w]*))\]){1}\s+(?<message>.*)$'
+    time_format: '%Y-%m-%d %H:%M:%S.%L'
+    time_keep: Off
+    time_key: log_time
+
+  - name: heat
+    format: regex
+    regex: '^(?<log_time>[^ ][-.\d\+:T]+[ ]*[.:\d]*)\s+(?<pid>[^ ]\d+)\s+(?<severity>[^ ][.-_\w]+)\s+(?<component>[^ ][.-_\w]+)(\s+\[(-|(?<req_id>[^ ][-\w]*) (?<req_user>[^ ][-\w]*) (?<req_project>[^ ][-\w]*) (?<req_domain>[^ ][-\w]*) (?<req_user_domain>[^ ][-\w]*) (?<req_project_domain>[^ ][-\w]*))\]){1}\s+(?<message>.*)$'
+    time_format: '%Y-%m-%d %H:%M:%S.%L'
+    time_keep: Off
+    time_key: log_time
+
+  - name: keystone
+    format: regex
+    regex: '^(?<log_time>[^ ][-.\d\+:T]+[ ]*[.:\d]*)\s+(?<pid>[^ ]\d+)\s+(?<severity>[^ ][.-_\w]+)\s+(?<component>[^ ][.-_\w]+)(\s+\[(-|(?<req_id>[^ ][-\w]*) (?<req_user>[^ ][-\w]*) (?<req_project>[^ ][-\w]*) (?<req_domain>[^ ][-\w]*) (?<req_user_domain>[^ ][-\w]*) (?<req_project_domain>[^ ][-\w]*))\]){1}\s+(?<message>.*)$'
+    time_format: '%Y-%m-%d %H:%M:%S.%L'
+    time_keep: Off
+    time_key: log_time
+
+  - name: neutron
+    format: regex
+    regex: '^(?<log_time>[^ ][-.\d\+:T]+[ ]*[.:\d]*)\s+(?<pid>[^ ]\d+)\s+(?<severity>[^ ][.-_\w]+)\s+(?<component>[^ ][.-_\w]+)(\s+\[(-|(?<req_id>[^ ][-\w]*) (?<req_user>[^ ][-\w]*) (?<req_project>[^ ][-\w]*) (?<req_domain>[^ ][-\w]*) (?<req_user_domain>[^ ][-\w]*) (?<req_project_domain>[^ ][-\w]*))\]){1}\s+(?<message>.*)$'
+    time_format: '%Y-%m-%d %H:%M:%S.%L'
+    time_keep: Off
+    time_key: log_time
+
+  - name: nova
+    format: regex
+    regex: '^(?<log_time>[^ ][-.\d\+:T]+[ ]*[.:\d]*)\s+(?<pid>[^ ]\d+)\s+(?<severity>[^ ][.-_\w]+)\s+(?<component>[^ ][.-_\w]+)(\s+\[(-|(?<req_id>[^ ][-\w]*) (?<req_user>[^ ][-\w]*) (?<req_project>[^ ][-\w]*) (?<req_domain>[^ ][-\w]*) (?<req_user_domain>[^ ][-\w]*) (?<req_project_domain>[^ ][-\w]*))\]){1}\s+(?<message>.*)$'
+    time_format: '%Y-%m-%d %H:%M:%S.%L'
+    time_keep: Off
+    time_key: log_time

From f9507ef0bed393293f6c0a777d33fc6c71005f12 Mon Sep 17 00:00:00 2001
From: Hank Leininger <hlein@korelogic.com>
Date: Tue, 18 Nov 2025 15:59:18 -0700
Subject: [PATCH 6/7] docs: examples: multiline: convert examples from conf to
 yaml

Signed-off-by: Hank Leininger <hlein@korelogic.com>
---
 .../filter_multiline/fluent-bit.conf          |  3 ++-
 ..._multiline.conf => parsers_multiline.yaml} | 18 +++++++++++------
 .../multiline/regex-001/fluent-bit.conf       |  3 ++-
 ..._multiline.conf => parsers_multiline.yaml} | 20 ++++++++++++-------
 examples/wasi_serde_json/README.md            | 19 +++++++++---------
 5 files changed, 39 insertions(+), 24 deletions(-)
 rename documentation/examples/multiline/filter_multiline/{parsers_multiline.conf => parsers_multiline.yaml} (56%)
 rename documentation/examples/multiline/regex-001/{parsers_multiline.conf => parsers_multiline.yaml} (54%)

diff --git a/documentation/examples/multiline/filter_multiline/fluent-bit.conf b/documentation/examples/multiline/filter_multiline/fluent-bit.conf
index 7ac6e63a109..6b0981cc9a3 100644
--- a/documentation/examples/multiline/filter_multiline/fluent-bit.conf
+++ b/documentation/examples/multiline/filter_multiline/fluent-bit.conf
@@ -1,7 +1,8 @@
 [SERVICE]
     flush                 1
     log_level             info
-    parsers_file          parsers_multiline.conf
+    #parsers_file          parsers_multiline.conf
+    parsers_file          parsers_multiline.yaml
 
 [INPUT]
     name                  tail
diff --git a/documentation/examples/multiline/filter_multiline/parsers_multiline.conf b/documentation/examples/multiline/filter_multiline/parsers_multiline.yaml
similarity index 56%
rename from documentation/examples/multiline/filter_multiline/parsers_multiline.conf
rename to documentation/examples/multiline/filter_multiline/parsers_multiline.yaml
index 6e03892b538..99a680c43b5 100644
--- a/documentation/examples/multiline/filter_multiline/parsers_multiline.conf
+++ b/documentation/examples/multiline/filter_multiline/parsers_multiline.yaml
@@ -1,7 +1,7 @@
-[MULTILINE_PARSER]
-    name          multiline-regex-test
-    type          regex
-    # Regex rules for multiline parsing
+multiline_parsers:
+  - name: multiline-regex-test
+    type: regex
+    #regex: rules for multiline parsing
     # ---------------------------------
     #
     # configuration hints:
@@ -11,5 +11,11 @@
     #
     # rules   |   state name   | regex pattern                   | next state name
     # --------|----------------|--------------------------------------------------
-    rule         "start_state"   "/(Dec \d+ \d+\:\d+\:\d+)(.*)/"  "cont"
-    rule         "cont"          "/^\s+at.*/"                     "cont"
+    rules:
+      - state: start_state
+        regex: '/(Dec \d+ \d+\:\d+\:\d+)(.*)/'
+        next_state: cont
+
+      - state: cont
+        regex: /^\s+at.*/
+        next_state: cont
diff --git a/documentation/examples/multiline/regex-001/fluent-bit.conf b/documentation/examples/multiline/regex-001/fluent-bit.conf
index 202a9163ace..6d51872b58e 100644
--- a/documentation/examples/multiline/regex-001/fluent-bit.conf
+++ b/documentation/examples/multiline/regex-001/fluent-bit.conf
@@ -1,7 +1,8 @@
 [SERVICE]
     flush        1
     log_level    info
-    parsers_file parsers_multiline.conf
+    #parsers_file parsers_multiline.conf
+    parsers_file parsers_multiline.yaml
 
 [INPUT]
     name             tail
diff --git a/documentation/examples/multiline/regex-001/parsers_multiline.conf b/documentation/examples/multiline/regex-001/parsers_multiline.yaml
similarity index 54%
rename from documentation/examples/multiline/regex-001/parsers_multiline.conf
rename to documentation/examples/multiline/regex-001/parsers_multiline.yaml
index 8a6ae658d14..0a4fb2b5c29 100644
--- a/documentation/examples/multiline/regex-001/parsers_multiline.conf
+++ b/documentation/examples/multiline/regex-001/parsers_multiline.yaml
@@ -1,8 +1,8 @@
-[MULTILINE_PARSER]
-    name          multiline-regex-test
-    type          regex
-    flush_timeout 1000
-    # Regex rules for multiline parsing
+multiline_parsers:
+  - name: multiline-regex-test
+    type: regex
+    flush_timeout: 1000
+    #regex: rules for multiline parsing
     # ---------------------------------
     #
     # configuration hints:
@@ -12,5 +12,11 @@
     #
     # rules   |   state name   | regex pattern                   | next state name
     # --------|----------------|--------------------------------------------------
-    rule         "start_state"   "/(Dec \d+ \d+\:\d+\:\d+)(.*)/"  "cont"
-    rule         "cont"          "/^\s+at.*/"                     "cont"
+    rules:
+      - state: start_state
+        regex: '/(Dec \d+ \d+\:\d+\:\d+)(.*)/'
+        next_state: cont
+
+      - state: cont
+        regex: /^\s+at.*/
+        next_state: cont
diff --git a/examples/wasi_serde_json/README.md b/examples/wasi_serde_json/README.md
index c9b2155483b..35ab737b8b4 100644
--- a/examples/wasi_serde_json/README.md
+++ b/examples/wasi_serde_json/README.md
@@ -31,14 +31,14 @@ target/wasm32-wasip1/release/wasi_serde_json.wasm
 
 ## How to confirm WASI integration
 
-Create parsers.conf as follows:
-
-```ini
-[PARSER]
-    Name        wasi
-    Format      json
-    Time_Key    time
-    Time_Format %Y-%m-%dT%H:%M:%S.%L %z
+Create parsers.yaml as follows:
+
+```yaml
+parsers:
+  - name: wasi
+    format: json
+    time_key: time
+    time_format: '%Y-%m-%dT%H:%M:%S.%L %z'
 ```
 
 And Create fluent-bit configuration file as follows:
@@ -47,7 +47,8 @@ And Create fluent-bit configuration file as follows:
 [SERVICE]
     Flush        1
     Daemon       Off
-    Parsers_File parsers.conf
+    #Parsers_File parsers.conf
+    Parsers_File parsers.yaml
     Log_Level    info
     HTTP_Server  Off
     HTTP_Listen  0.0.0.0

From ee5a9ae7004837e5b754c3ffcbde9cadd05298a1 Mon Sep 17 00:00:00 2001
From: Hank Leininger <hlein@korelogic.com>
Date: Sat, 22 Nov 2025 13:08:39 -0700
Subject: [PATCH 7/7] config_format: Add parser*.yaml references alongside
 parser*.conf

Install parser*.yaml files alongside .conf and add commented-out
references to them in other configs.

Signed-off-by: Hank Leininger <hlein@korelogic.com>
---
 CMakeLists.txt                 | 1 +
 conf/fluent-bit-macos.conf     | 1 +
 conf/fluent-bit-win32.conf     | 1 +
 conf/fluent-bit.conf           | 1 +
 conf/kube.conf                 | 1 +
 conf/kube_elasticsearch.conf   | 1 +
 conf/rate_limit.conf           | 3 ++-
 cpack/debian/conffiles         | 1 +
 dockerfiles/Dockerfile         | 6 ++++++
 dockerfiles/Dockerfile.windows | 6 ++++++
 src/CMakeLists.txt             | 5 +++++
 11 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 05fac0673d3..3d75566e08a 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1523,6 +1523,7 @@ set(CPACK_RPM_SPEC_MORE_DEFINE "%define ignore \#")
 set(CPACK_RPM_RUNTIME_USER_FILELIST
   "%config(noreplace) /etc/${FLB_OUT_NAME}/${FLB_OUT_NAME}.conf"
   "%config(noreplace) /etc/${FLB_OUT_NAME}/parsers.conf"
+  "%config(noreplace) /etc/${FLB_OUT_NAME}/parsers.yaml"
   "%config(noreplace) /etc/${FLB_OUT_NAME}/plugins.conf"
   "%ignore /lib"
   "%ignore /lib/systemd"
diff --git a/conf/fluent-bit-macos.conf b/conf/fluent-bit-macos.conf
index 05da7ee69ed..0b3fc0aae2e 100644
--- a/conf/fluent-bit-macos.conf
+++ b/conf/fluent-bit-macos.conf
@@ -26,6 +26,7 @@
     # ============
     # specify an optional 'Parsers' configuration file
     parsers_file parsers.conf
+    #parsers_file parsers.yaml
 
     # Plugins File
     # ============
diff --git a/conf/fluent-bit-win32.conf b/conf/fluent-bit-win32.conf
index a27ac5da9bf..016759629b2 100644
--- a/conf/fluent-bit-win32.conf
+++ b/conf/fluent-bit-win32.conf
@@ -26,6 +26,7 @@
     # ============
     # specify an optional 'Parsers' configuration file
     parsers_file parsers.conf
+    #parsers_file parsers.yaml
 
     # Plugins File
     # ============
diff --git a/conf/fluent-bit.conf b/conf/fluent-bit.conf
index bf3269f38e2..059c91cde53 100644
--- a/conf/fluent-bit.conf
+++ b/conf/fluent-bit.conf
@@ -26,6 +26,7 @@
     # ============
     # specify an optional 'Parsers' configuration file
     parsers_file parsers.conf
+    #parsers_file parsers.yaml
 
     # Plugins File
     # ============
diff --git a/conf/kube.conf b/conf/kube.conf
index ab7ef150cfd..a889ad6d8f7 100644
--- a/conf/kube.conf
+++ b/conf/kube.conf
@@ -3,6 +3,7 @@
     Daemon       Off
     Log_Level    info
     Parsers_File parsers.conf
+    #Parsers_File parsers.yaml
 
 [INPUT]
     Name          tail
diff --git a/conf/kube_elasticsearch.conf b/conf/kube_elasticsearch.conf
index 50ca2e1022d..cd4a37be117 100644
--- a/conf/kube_elasticsearch.conf
+++ b/conf/kube_elasticsearch.conf
@@ -3,6 +3,7 @@
     Daemon       Off
     Log_Level    info
     Parsers_File parsers.conf
+    #Parsers_File parsers.yaml
 
 [INPUT]
     Name          tail
diff --git a/conf/rate_limit.conf b/conf/rate_limit.conf
index 9fdc8311e2c..d66db142ae1 100644
--- a/conf/rate_limit.conf
+++ b/conf/rate_limit.conf
@@ -3,6 +3,7 @@
     Daemon       Off
     Log_Level    info
     Parsers_File parsers.conf
+    #Parsers_File parsers.yaml
 
 [INPUT]
     Name          tail
@@ -22,4 +23,4 @@
     call   rate_limit
 [OUTPUT]
     Name  stdout
-    Match *
\ No newline at end of file
+    Match *
diff --git a/cpack/debian/conffiles b/cpack/debian/conffiles
index 897702fc325..2ba603deb07 100644
--- a/cpack/debian/conffiles
+++ b/cpack/debian/conffiles
@@ -1,3 +1,4 @@
 /etc/fluent-bit/parsers.conf
+/etc/fluent-bit/parsers.yaml
 /etc/fluent-bit/plugins.conf
 /etc/fluent-bit/fluent-bit.conf
diff --git a/dockerfiles/Dockerfile b/dockerfiles/Dockerfile
index 33a832888c9..7cbe74595ae 100644
--- a/dockerfiles/Dockerfile
+++ b/dockerfiles/Dockerfile
@@ -106,6 +106,12 @@ COPY conf/fluent-bit.conf \
     conf/parsers_extra.conf \
     conf/parsers_openstack.conf \
     conf/parsers_cinder.conf \
+    conf/parsers.yaml \
+    conf/parsers_ambassador.yaml \
+    conf/parsers_java.yaml \
+    conf/parsers_extra.yaml \
+    conf/parsers_openstack.yaml \
+    conf/parsers_cinder.yaml \
     conf/plugins.conf \
     /fluent-bit/etc/
 
diff --git a/dockerfiles/Dockerfile.windows b/dockerfiles/Dockerfile.windows
index e40800f2535..7ff521ac497 100644
--- a/dockerfiles/Dockerfile.windows
+++ b/dockerfiles/Dockerfile.windows
@@ -193,6 +193,12 @@ RUN New-Item -Path  /fluent-bit/etc/ -ItemType "directory"; `
     Copy-Item -Path /src/conf/parsers_extra.conf /fluent-bit/etc/; `
     Copy-Item -Path /src/conf/parsers_openstack.conf /fluent-bit/etc/; `
     Copy-Item -Path /src/conf/parsers_cinder.conf /fluent-bit/etc/; `
+    Copy-Item -Path /src/conf/parsers.yaml /fluent-bit/etc/; `
+    Copy-Item -Path /src/conf/parsers_ambassador.yaml /fluent-bit/etc/; `
+    Copy-Item -Path /src/conf/parsers_java.yaml /fluent-bit/etc/; `
+    Copy-Item -Path /src/conf/parsers_extra.yaml /fluent-bit/etc/; `
+    Copy-Item -Path /src/conf/parsers_openstack.yaml /fluent-bit/etc/; `
+    Copy-Item -Path /src/conf/parsers_cinder.yaml /fluent-bit/etc/; `
     Copy-Item -Path /src/conf/plugins.conf /fluent-bit/etc/; `
     Copy-Item -Path /src/build/bin/fluent-bit.exe /fluent-bit/bin/;
 
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index ac5fe5ef863..687f58d8e25 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -657,6 +657,11 @@ if(FLB_BINARY)
       RENAME "${FLB_OUT_NAME}.conf")
   endif()
 
+  install(FILES
+    "${PROJECT_SOURCE_DIR}/conf/parsers.yaml"
+    COMPONENT binary
+    DESTINATION ${FLB_INSTALL_CONFDIR})
+
   install(FILES
     "${PROJECT_SOURCE_DIR}/conf/parsers.conf"
     COMPONENT binary