Actual record overridden after parsing

[kumaravel29]

In the fluentd input, I am using a parser in the syslog input plugin to break the messages using regular expression. After the separation, I am trying to parse one of the field again using the multi-format-parser.

Output after input plugin - {"field1":"abc", "field2":"xyz", "message":"{"field3":"def", "field4":"ghi"}"} Output after multi-format-parser - {"field3":"def", "field4":"ghi"}

Is there a way to retain the actual fields also.

[repeatedly]

If you use filter_parser plugin, consider https://docs.fluentd.org/v1.0/articles/filter_parser#reserve_data