-
Notifications
You must be signed in to change notification settings - Fork 5.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Doc how to parse telegraf logs #4285
Doc how to parse telegraf logs #4285
Conversation
57f78a3
to
e1c4847
Compare
e1c4847
to
1030078
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks, this will be a handle tutorial as well as being directly useful.
plugins/inputs/logparser/README.md
Outdated
We can use logparser to convert the log lines generated by Telegraf in metrics. | ||
|
||
To do this we need to configure Telegraf to write logs to a file (if we have systemd, by | ||
default, it will be written to journald): |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This isn't always the case, on most systems I have tested by default journald is setup to forward to rsyslog, when then writes the logs to /var/log/syslog
. See #4174
What's important is that the admin sets up the telegraf logs to go into a dedicated file, and this will do that, but maybe we should also mention that on some systems you can also do this from your syslog handler.
plugins/inputs/logparser/README.md
Outdated
|
||
[inputs.logparser.grok] | ||
measurement = "telegraf_log" | ||
patterns = ['\A%{TIMESTAMP_ISO8601:timestamp:ts-rfc3339} %{TELEGRAF_LOG_LEVEL:level:tag}! %{GREEDYDATA:msg}'] |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
\A
?
…e 'beginning of line' instead of 'beginning of text'
Required for all PRs: