How to use aggregators?

Telegraf
1

I am trying to use the logparser plugin with the histogram aggregator plugin but can’t get it to work.

What am I missing here?

Here is my config:

[agent]
  interval = "5s"

[[outputs.file]]
  files = ["stdout"]

[[aggregators.histogram]]
  period = "10s"
  drop_original = false
  [[aggregators.histogram.config]]
    buckets = [0.0, 100.0, 200.0, 300.0, 400.0, 500.0]
    measurement_name = "testmetric"
    fields = ["resp_code"]
  [[aggregators.histogram.config]]
    buckets = [0.0, 15.6, 34.5, 49.1, 71.5, 80.5, 94.5, 100.0]
    measurement_name = "cpu"

[[inputs.cpu]]
  percpu = false
  totalcpu = true

[[inputs.logparser]]
  files = ["/tmp/test.log"]
  from_beginning = false
  name_override = "testmetric"
  [inputs.logparser.grok]
    patterns = ["%{COMBINED_LOG_FORMAT}"]

To test echo some log lines:
echo '127.0.0.1 ident auth [10/Oct/2000:13:55:36 -0700] "GET /apache_pb.gif HTTP/1.0" 200 2326 "http://localhost:8083/" "Chrome/51.0.2704.84"' >> /tmp/test.log

But I never see logparser metrics aggregated through histogram. I do see the cpu metrics however. Output:

    2017-09-26T16:43:45Z I! Starting Telegraf v1.4.0
    2017-09-26T16:43:45Z I! Loaded outputs: file
    2017-09-26T16:43:45Z I! Loaded inputs: inputs.cpu inputs.logparser
    2017-09-26T16:43:45Z I! Tags enabled: host=ip-10-129-88-74.vpc.internal
    2017-09-26T16:43:45Z I! Agent Config: Interval:5s, Quiet:false, Hostname:"ip-10-129-88-74.vpc.internal", Flush Interval:10s
    testmetric,verb=GET,resp_code=200,path=/tmp/test.log,host=ip-10-129-88-74.vpc.internal resp_bytes=2326i,agent="Chrome/51.0.2704.84",client_ip="127.0.0.1",ident="ident",http_version=1,auth="auth",request="/apache_pb.gif",referrer="http://localhost:8083/" 971211336000000000
    testmetric,path=/tmp/test.log,host=ip-10-129-88-74.vpc.internal,verb=GET,resp_code=200 auth="auth",resp_bytes=2326i,referrer="http://localhost:8083/",agent="Chrome/51.0.2704.84",client_ip="127.0.0.1",request="/apache_pb.gif",http_version=1,ident="ident" 971211336001000000
    cpu,cpu=cpu-total,host=ip-10-129-88-74.vpc.internal usage_idle=99.59839357450608,usage_nice=0,usage_iowait=0,usage_irq=0,usage_steal=0,usage_guest_nice=0,usage_user=0.4016064257039481,usage_system=0,usage_softirq=0,usage_guest=0 1506444235000000000
    cpu,cpu=cpu-total,host=ip-10-129-88-74.vpc.internal usage_guest=0,usage_guest_nice=0,usage_user=0,usage_iowait=0,usage_softirq=0,usage_steal=0,usage_system=0,usage_idle=100,usage_nice=0,usage_irq=0 1506444240000000000
    cpu,cpu=cpu-total,host=ip-10-129-88-74.vpc.internal usage_user_min=0.4016064257039481,usage_softirq_min=0,usage_guest_max=0,usage_idle_max=99.59839357450608,usage_guest_min=0,usage_irq_min=0,usage_guest_nice_max=0,usage_steal_min=0,usage_iowait_max=0,usage_system_min=0,usage_nice_max=0,usage_iowait_min=0,usage_steal_max=0,usage_user_max=0.4016064257039481,usage_system_max=0,usage_softirq_max=0,usage_nice_min=0,usage_idle_min=99.59839357450608,usage_irq_max=0,usage_guest_nice_min=0 1506444240000000000
    cpu,le=0,cpu=cpu-total,host=ip-10-129-88-74.vpc.internal usage_irq_bucket=1i,usage_user_bucket=0i,usage_softirq_bucket=1i,usage_iowait_bucket=1i,usage_nice_bucket=1i,usage_idle_bucket=0i,usage_steal_bucket=1i,usage_guest_nice_bucket=1i,usage_guest_bucket=1i,usage_system_bucket=1i 1506444240000000000
    cpu,host=ip-10-129-88-74.vpc.internal,le=15.6,cpu=cpu-total usage_guest_nice_bucket=1i,usage_iowait_bucket=1i,usage_nice_bucket=1i,usage_user_bucket=1i,usage_system_bucket=1i,usage_steal_bucket=1i,usage_guest_bucket=1i,usage_irq_bucket=1i,usage_softirq_bucket=1i,usage_idle_bucket=0i 1506444240000000000
    cpu,cpu=cpu-total,host=ip-10-129-88-74.vpc.internal,le=34.5 usage_nice_bucket=1i,usage_idle_bucket=0i,usage_irq_bucket=1i,usage_softirq_bucket=1i,usage_iowait_bucket=1i,usage_system_bucket=1i,usage_user_bucket=1i,usage_guest_bucket=1i,usage_steal_bucket=1i,usage_guest_nice_bucket=1i 1506444240000000000
    cpu,cpu=cpu-total,host=ip-10-129-88-74.vpc.internal,le=49.1 usage_idle_bucket=0i,usage_softirq_bucket=1i,usage_steal_bucket=1i,usage_user_bucket=1i,usage_iowait_bucket=1i,usage_guest_bucket=1i,usage_irq_bucket=1i,usage_nice_bucket=1i,usage_system_bucket=1i,usage_guest_nice_bucket=1i 1506444240000000000
    cpu,cpu=cpu-total,host=ip-10-129-88-74.vpc.internal,le=71.5 usage_system_bucket=1i,usage_irq_bucket=1i,usage_iowait_bucket=1i,usage_user_bucket=1i,usage_softirq_bucket=1i,usage_guest_nice_bucket=1i,usage_nice_bucket=1i,usage_idle_bucket=0i,usage_steal_bucket=1i,usage_guest_bucket=1i 1506444240000000000
    cpu,cpu=cpu-total,host=ip-10-129-88-74.vpc.internal,le=80.5 usage_guest_nice_bucket=1i,usage_nice_bucket=1i,usage_system_bucket=1i,usage_irq_bucket=1i,usage_steal_bucket=1i,usage_idle_bucket=0i,usage_iowait_bucket=1i,usage_user_bucket=1i,usage_softirq_bucket=1i,usage_guest_bucket=1i 1506444240000000000
    cpu,cpu=cpu-total,host=ip-10-129-88-74.vpc.internal,le=94.5 usage_iowait_bucket=1i,usage_guest_bucket=1i,usage_irq_bucket=1i,usage_user_bucket=1i,usage_system_bucket=1i,usage_idle_bucket=0i,usage_steal_bucket=1i,usage_guest_nice_bucket=1i,usage_nice_bucket=1i,usage_softirq_bucket=1i 1506444240000000000
    cpu,cpu=cpu-total,host=ip-10-129-88-74.vpc.internal,le=100 usage_guest_bucket=1i,usage_guest_nice_bucket=1i,usage_irq_bucket=1i,usage_softirq_bucket=1i,usage_user_bucket=1i,usage_system_bucket=1i,usage_idle_bucket=1i,usage_steal_bucket=1i,usage_iowait_bucket=1i,usage_nice_bucket=1i 1506444240000000000
    cpu,host=ip-10-129-88-74.vpc.internal,le=+Inf,cpu=cpu-total usage_iowait_bucket=1i,usage_steal_bucket=1i,usage_guest_nice_bucket=1i,usage_guest_bucket=1i,usage_nice_bucket=1i,usage_idle_bucket=1i,usage_irq_bucket=1i,usage_softirq_bucket=1i,usage_system_bucket=1i,usage_user_bucket=1i 1506444240000000000
2

The first issue seems to be that resp_code is a tag and not a field. Tags cannot be added to a histogram because they are not numeric types, but you could change it to an integer if you override the default grok pattern:

[[inputs.logparser]]
  files = ["/tmp/test.log"]
  from_beginning = false
  name_override = "testmetric"
  [inputs.logparser.grok]
    patterns = ["%{COMBINED_LOG_FORMAT}"]
    custom_patterns = '''
		COMMON_LOG_FORMAT %{CLIENT:client_ip} %{NOTSPACE:ident} %{NOTSPACE:auth} \[%{HTTPDATE:ts:ts-httpd}\] "(?:%{WORD:verb:tag} %{NOTSPACE:request}(?: HTTP/%{NUMBER:http_version:float})?|%{DATA})" %{NUMBER:resp_code:int} (?:%{NUMBER:resp_bytes:int}|-)
		COMBINED_LOG_FORMAT %{COMMON_LOG_FORMAT} %{QS:referrer} %{QS:agent}
    '''

Now that resp_code is an integer it should work, but the sample logfile you are adding still will not produce any histogram metrics. The problem is that the log entry is from Oct 2000, but aggregators only operate within their period, and any metrics with a timestamp older than this are skipped. There are more details about this behavior near the end of the aggregators document.

3

Thank you so much Daniel. Got it working now.

1 Like