Extracting part of log message as a field

Telegraf
,
1

Hi,

I have a log file that i want to parse and send the data to my influx database.So here is the thing that i want to do

Consider the two types of log that i want to parse:

First :
Jun 30 00:46:36 raspberrypi mender[869]: level=error msg=“failed to send deployment logs to server: transient error: failed to send deployment logs: transient error: (request_id: ): uploading logs failed, bad status 413 server error message: failed to parse server response: invalid character ‘<’ looking for beginning of value”

Second :
Jun 30 12:07:23 raspberrypi rngd[396]: stats: FIPS 140-2(2001-10-10) Runs: 0

now i want to have the following data in my InfluxDB:
for first log:

column Name - column value

time - 1593672519370595355
severity - error(extracted from the first log)
value - Jun 30 00:46:36 raspberrypi mender[869]: level=error msg=“failed to send deployment logs to server: transient error: failed to send deployment logs: transient error: (request_id: ): uploading logs failed, bad status 413 server error message: failed to parse server response: invalid character ‘<’ looking for beginning of value” (complete first log)

for second log:

time - 1593672519370614724
severity - (empty since there is no error indication in the log)
value - Jun 30 12:07:23 raspberrypi rngd[396]: stats: FIPS 140-2(2001-10-10) Runs: 0 (complete second log)

what config of input.tail should i use to achieve this output?

2

Hello @mrAbhishek,
You could try using the Grok input plugin. Or you could write a script and convert the logs into line protocol with a script in the language of your choosing and use this plugin to run the script: telegraf/plugins/inputs/exec at master · influxdata/telegraf · GitHub