Using this plugin I found the trace-id was getting pulled into the target-group arn field. I corrected the regex to stop the match at the first whitespace and tested the new reqex using: http://rubular.com/ and the following log line `http 2018-03-15T03:50:00.337397Z app/svc-hg-production-east-blue-2/dcf5479ed8d03bc6 10.248.9.92:54000 10.248.9.77:80 0.000 0.052 0.000 200 200 686 6476 "GET http://services-lb.nottherealsite.net:80/svc/v3_4/providersearch/ProviderProfile/772AZ?s.what=Speech-Language+Pathology&s.where=Forest+Park%2c+IL+60130&s.pt=41.864907%2c-87.804277&s.SearchType=PracticingSpecialty&s.EntityCode=PS1023&cw.FacetLazyLoad=true&cw.Facet=false&s.PracticingSpecialtyCodes=%22PS1023%22&experienceScore=true&compareWidget=True HTTP/1.1" "-" - - arn:aws:elasticloadbalancing:us-east-1:123456789123:targetgroup/prod-svc-b-0-i/39a872227ad8676a "Root=1-5aa9ed68-609415c9be383a14005cd7d1" "-" "-" 3`
Using this plugin I found the trace-id was getting pulled into the target-group arn field. I corrected the regex to stop the match at the first whitespace and tested the new reqex using: http://rubular.com/ and the following log line `http 2018-03-15T03:50:00.337397Z app/svc-hg-production-east-blue-2/dcf5479ed8d03bc6 10.248.9.92:54000 10.248.9.77:80 0.000 0.052 0.000 200 200 686 6476 "GET http://services-lb.nottherealsite.net:80/svc/v3_4/providersearch/ProviderProfile/772AZ?s.what=Speech-Language+Pathology&s.where=Forest+Park%2c+IL+60130&s.pt=41.864907%2c-87.804277&s.SearchType=PracticingSpecialty&s.EntityCode=PS1023&cw.FacetLazyLoad=true&cw.Facet=false&s.PracticingSpecialtyCodes=%22PS1023%22&experienceScore=true&compareWidget=True HTTP/1.1" "-" - - arn:aws:elasticloadbalancing:us-east-1:123456789123:targetgroup/prod-svc-b-0-i/39a872227ad8676a "Root=1-5aa9ed68-609415c9be383a14005cd7d1" "-" "-" 3`

shinsaka/fluent-plugin-elb-log