The file is like this:
Timestamp | Total Queued || Queued in P0 | Queued in P1 | Dropped | All | Process | Modload | File | Net | DNS | Proxy | Blocked | Other |
131922145722147338 | 0 || 0 | 0 | 0 | 3 | 0 | 0 | 0 | 0 | 2 | 0 | 0 | 1 |
131922145872546833 | 0 || 0 | 0 | 0 | 4 | 0 | 0 | 0 | 0 | 2 | 0 | 0 | 2 |
My configuration is:
[[inputs.logparser]]
files =["/etc/telegraf/example-detail"]
from_beginning =false
watch_method = “inotify”
[inputs.logparser.grok]
patterns = ["%{EVENTS}"]
custom_patterns =’’’
EVENTS %{DATA:timestamp:ts-epochnano}|%{DATA:int}||%{NUMBER:int}||%{DATA:int}|%{DATA:int}|%{DATA:int}|%{DATA:int}|%{DATA:int}|%{DATA:int}|%{DATA:int}|%{DATA:int}|%{DATA:int}|%{DATA:int}|%{DATA:int}"]
‘’’
measurement=“P_EVENTS”
timezone = “Local”
This is the error:
Jan 18 18:20:57 tl-rhel-74 telegraf[2210]: 2019-01-18T23:20:57Z E! Error parsing log line: grok: must have one or more fields
Jan 18 18:20:57 tl-rhel-74 telegraf[2210]: 2019-01-18T23:20:57Z E! Error parsing log line: grok: must have one or more fields
Jan 18 18:20:57 tl-rhel-74 telegraf[2210]: 2019-01-18T23:20:57Z E! Error parsing log line: grok: must have one or more fields
Jan 18 18:20:57 tl-rhel-74 telegraf[2210]: 2019-01-18T23:20:57Z E! Error parsing log line: grok: must have one or more fields
