I’m using telegraf (1.4.2) to gather IIS logs and send them to InfluxDB. The log parser is grabbing the correct files and I have the grok pattern working but I noticed that all the data is being treated as a field. In the documentation (telegraf/plugins/inputs/logparser at master · influxdata/telegraf · GitHub) is says:
“By default all named captures are converted into string fields.”
Is there a way to create tags? A number of fields don’t work well as a field
It sounds like you are probably in Windows, in which case you need to set the watch_method to poll since inotify only works on Linux. However, this feature only works on the nightly builds now and will be in version 1.5.0.