Imaginary uses an Apache-compatible log format. You can ingest these logs using Fluentd by applying a parser filter to separate access logs from warning/error logs.
Access logs (containing a code field) will be tagged with *.imaginary.access, while warning and error logs (lacking a code field) will be tagged with *.imaginary.error.
# use your own tag name (*.imaginary for this example)
<filter *.imaginary>
@type parser
key_name log
reserve_data true
<parse>
@type multi_format
# access logs parser
<pattern>
format regexp
expression /^[^ ]* [^ ]* [^ ]* \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^ ]*) +\S*)?" (?<code>[^ ]*) (?<size>[^ ]*) (?<response_time>[^ ]*)$/
types code:integer,size:integer,response_time:float
time_key time
time_format %d/%b/%Y %H:%M:%S
</pattern>
# warnings / error logs parser
<pattern>
format none
message_key message
</pattern>
</parse>
</filter>
<match *.imaginary>
@type rewrite_tag_filter
# Logs with code field are access logs, and logs without are error logs
<rule>
key code
pattern ^.+$
tag ${tag}.access
</rule>
<rule>
key code
pattern ^.+$
invert true
tag ${tag}.error
</rule>
</match>
