parsers.conf へ以下を記載
[PARSER]
Name tomcat_access_log
Format regex
Regex ^(?<xff>\S+) (?<remote_host>\S+) (?<user>\S+) \[(?<time>[^\]]+)\] "(?<method>\S+) (?<path>[^\s\?]+)(?<query>\?[^\s"]*)? (?<protocol>[^"]+)" (?<status>\d+) (?<bytes_sent>\d+) (?<response_time>\d+) (?<thread>\S+) (?<referer>\S+) (?<agent>.*)$