InfluxDB 2.4 breaking out Syslog message to multiple columns


I’m setting up an InfluxDB 2.4 server to eventually replace my 2.2 server and there is an issue with Data Explorer.

In the 2.2 version I have a syslog message in the “_value” field that has info separated with commas. I have other columns like _measurements, host, hostname, severity etc that have the correct info in it based on the syslog event.

In the 2.4 version, Data Explorer is breaking out the syslog message and treating it as column delimited. Basically, I get the _value broken out and pushed into the next columns. Now I have an offset where part of the message is in _measurements, host, hostname and the data in those columns are shifted down into the next column over. As an example, my Severity column that should have “info” or “err” in it has the hostname. However, if I look in RAW DATA view, everything is correct and in their proper columns. Including my full syslog event inside the _value column intact.

I’m just checking whether this is a bug that I should report in Github or whether there is some new feature to column delimit that I need to disable. I couldn’t find anything on either.

@R0bR This is a bug and should be fixed in 2.5, which should be shipping any day. This particular bug has be fixed and regressed a few times, so hopefully it sticks :smile:

Awesome. Thanks @scott !