Input.Tail with json tag_key

Telegraf
1

Hi guys!

I am trying to collect my Traefik access log (JSON output) with the Input.Tail input. Works perfectly fine, however I only have 2 keys and I want to extend that.

Example JSON:

{"ClientAddr":"10.13.37.5:53958","ClientHost":"10.13.37.5","ClientPort":"53958","ClientUsername":"-","DownstreamContentSize":454,"DownstreamStatus":200,"Duration":917770,"OriginContentSize":454,"OriginDuration":744835,"OriginStatus":200,"Overhead":172935,"RequestAddr":"traefik.thijmen.dev","RequestContentSize":0,"RequestCount":8040,"RequestHost":"traefik.domain","RequestMethod":"GET","RequestPath":"/api/overview","RequestPort":"-","RequestProtocol":"HTTP/2.0","RequestScheme":"https","RetryAttempts":0,"RouterName":"https-api@file","StartLocal":"2020-06-12T10:50:43.108021341Z","StartUTC":"2020-06-12T10:50:43.108021341Z","entryPointName":"https","level":"info","msg":"","time":"2020-06-12T10:50:43Z"}

This is the config I have:

 [[inputs.tail]]
  files = ["/traefik-data/access_json.log"]
  data_format = "json"
  name_override = "traefik_log"
  json_string_fields = ["ClientAddr", "ClientHost", "ClientPort", "ClientUsername", "RequestAddr", "RequestHost", "RequestMethod", "RequestPath", "RequestPort", "RequestProtocol", "RequestScheme", "RouterName", "ServiceName"]
  json_time_key = "time"
  json_time_format = "2006-01-02T15:04:05Z07:00"

Now, I was thinking that while the documentation did not state that I could use config variables like json_time_key and json_time_format (telegraf/README.md at release-1.14 · influxdata/telegraf · GitHub), that did work actually. So, I thought I’d add the following as well to add extra keys.

tag_key = ["RouterName"]

This does unfortunately not work, while starting Telegraf I get the following error:

2020-06-12T10:45:54Z E! [telegraf] Error running agent: Error parsing /etc/telegraf/telegraf.conf, line 6396: field corresponding to `tag_key' is not defined in tail.Tail

Does anyone knows how to achieve what I am trying to achieve? I want all JSON fields as key so I can query them nicely in Grafana.

Thanks in advance and stay safe,

Thijmen

2

Fixed: should be tag_keys in stead of tag_key.

3

This topic was automatically closed 60 minutes after the last reply. New replies are no longer allowed.