From 6928c51aa8435c3f7b8a3f1bb93f3d19ddbf42fc Mon Sep 17 00:00:00 2001
From: Dennis Kaarsemaker <dennis@kaarsemaker.net>
Date: Fri, 8 Nov 2024 10:45:36 +0100
Subject: [PATCH] Add documentation for systemd per-service parsing
 configuration

Signed-off-by: Dennis Kaarsemaker <dennis@kaarsemaker.net>
---
 pipeline/inputs/systemd.md | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/pipeline/inputs/systemd.md b/pipeline/inputs/systemd.md
index 36066b090..ff92b6396 100644
--- a/pipeline/inputs/systemd.md
+++ b/pipeline/inputs/systemd.md
@@ -77,3 +77,24 @@ pipeline:
 ```
 {% endtab %}
 {% endtabs %}
+
+### Parsing the MESSAGE field
+
+By default, the _Systemd_ plugin logs all fields in the journal verbatim. If you want to parse the `MESSAGE` field, you can configure your service to specify a parser. For example, to parse the `MESSAGE` field as JSON, you can use something like the following systemd configuration:
+
+```yaml
+[Unit]
+Description=my-service
+After=network.target
+
+[Service]
+WorkingDirectory=/var/lib/my-service
+ExecStart=/usr/sbin/my-service
+Restart=always
+LogExtraFields=FLUENT_BIT_PARSER=json
+
+[Install]
+WantedBy=multi-user.target
+```
+
+`LogExtraFields` will make the specified fields appear in the log output. The `Systemd` plugin will look for a `FLUENT_BIT_PARSER` field and use it to parse the `MESSAGE` field. If the parser is not found or parsing fails, the unparsed message is added to the log entry as if no parser was specified.