{
    "message": "2021-12-09 11:34:28.279|INFO|605c643e29e4|BIN--Python|192.168.1.1"
}

//使用|作为分隔符(竖线需要转义)，从 message 中提取 time、loglevel、taskId、ProcessName、ip 字段.
ext_sepstr("message","time,loglevel,taskId,ProcessName,ip",sep="\\|")
//丢弃 message
fields_drop("message")

{
"ProcessName":"BIN--Python",
"ip":"192.168.1.1",
"loglevel":"INFO",
"taskId":"605c643e29e4",
"time":"2021-12-09 11:34:28.279"
}

{
    "regex": "2021-12-02 14:33:35.022 [1] INFO  org.apache.Load - Response:status: 200, resp msg: OK, resp content: {    \\"TxnId\\": 58322,    \\"Label\\": \\"flink_connector_20211202_1de749d8c80015a8\\",    \\"Status\\": \\"Success\\",    \\"Message\\": \\"OK\\",    \\"TotalRows\\": 1,    \\"LoadedRows\\": 1,    \\"FilteredRows\\": 0,  \\"CommitAndPublishTimeMs\\": 16}"
}

//使用逗号作为分隔符，将日志切成三段
ext_sepstr("regex", "f1, f2, f3", sep=",")
//仅保留 f3字段:即 resp content:及其后续的字符
fields_drop("regex","f1","f2")
//使用冒号来切割 f3字段值，仅保留{}和括号内的字符，存至 resp_content 字段，该字段是一个 json，是 flink 返回的消息包
ext_sepstr("f3", "f1,resp_content", sep=":")
fields_drop("f1","f3")
//对 resp_content 字段结构化
ext_json("resp_content", prefix="")
//丢弃原字段
fields_drop("resp_content")

{
"CommitAndPublishTimeMs":"16",
"FilteredRows":"0",
"Label":"flink_connector_20211202_1de749d8c80015a8",
"LoadedRows":"1",
"Message":"OK",
"Status":"Success",
"TotalRows":"1",
"TxnId":"58322"
}