Match multiple lines with telegraf

Telegraf
1

I want to use telegraf to parse Ruby on Rails logs.
How to make it match multiple lines when log message has more then 1 line?

My telegraf config is:

[agent]
  interval = 1
  flush_interval = 2

[[inputs.logparser]]
  files = ["/my_app/log/development.log"]
  from_beginning = true
  name_override = "rails_app"
  [inputs.logparser.grok]
    patterns = ["%{CUSTOM_CORE_LOG}"]
    custom_patterns = '''
      CUSTOM_CORE_LOG ^[DFEWI], \[%{TIMESTAMP_ISO8601:ts:ts-"2006-01-02T15:04:05.000000"} #%{POSINT:pid:int}\]\s+%{DATA:loglevel:tag} (\-\- :)?\s*%{GREEDYDATA:message}$
    '''
    timezone = "Local"

[[outputs.influxdb]]
  urls = ["http://localhost:8086"] # required
  database = "telegraf" # required
  timeout = "5s"

Normally it can process logs that looks like:

I, [2017-09-14T01:51:37.993447 #77375]  INFO -- : Started GET "/rails_app" for 127.0.0.1 at 2017-09-14 01:51:37 +0800
D, [2017-09-14T01:51:38.215931 #77375] DEBUG -- :    (3.4ms)  SET NAMES utf8,  @@SESSION.sql_mode = 'STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION',  @@SESSION.sql_auto_is_null = 0, @@SESSION.wait_timeout = 2147483
D, [2017-09-14T01:51:38.261140 #77375] DEBUG -- :    (1.1ms)  SELECT `schema_migrations`.`version` FROM `schema_migrations` ORDER BY `schema_migrations`.`version` ASC

But sometimes exception happen and telegraf can not record it:

F, [2017-09-14T01:51:38.273072 #77375] FATAL -- :   
F, [2017-09-14T01:51:38.273170 #77375] FATAL -- : ActionController::RoutingError (No route matches [GET] "/rails_app"):
F, [2017-09-14T01:51:38.273226 #77375] FATAL -- :   
F, [2017-09-14T01:51:38.273297 #77375] FATAL -- : actionpack (5.1.4) lib/action_dispatch/middleware/debug_exceptions.rb:63:in `call'
web-console (3.5.1) lib/web_console/middleware.rb:135:in `call_app'
web-console (3.5.1) lib/web_console/middleware.rb:28:in `block in call'
web-console (3.5.1) lib/web_console/middleware.rb:18:in `catch'
web-console (3.5.1) lib/web_console/middleware.rb:18:in `call'
actionpack (5.1.4) lib/action_dispatch/middleware/show_exceptions.rb:31:in `call'
railties (5.1.4) lib/rails/rack/logger.rb:36:in `call_app'
railties (5.1.4) lib/rails/rack/logger.rb:24:in `block in call'
activesupport (5.1.4) lib/active_support/tagged_logging.rb:69:in `block in tagged'
activesupport (5.1.4) lib/active_support/tagged_logging.rb:26:in `tagged'
...

Telegraf output:

....
2017-09-13T17:51:35Z D! Output [influxdb] buffer fullness: 0 / 10000 metrics. 
2017-09-13T17:51:37Z D! Output [influxdb] buffer fullness: 0 / 10000 metrics. 
2017-09-13T17:51:38Z D! Grok no match found for: "web-console (3.5.1) lib/web_console/middleware.rb:135:in `call_app'"
2017-09-13T17:51:38Z D! Grok no match found for: "web-console (3.5.1) lib/web_console/middleware.rb:28:in `block in call'"
2017-09-13T17:51:38Z D! Grok no match found for: "web-console (3.5.1) lib/web_console/middleware.rb:18:in `catch'"
2017-09-13T17:51:38Z D! Grok no match found for: "web-console (3.5.1) lib/web_console/middleware.rb:18:in `call'"
2017-09-13T17:51:38Z D! Grok no match found for: "actionpack (5.1.4) lib/action_dispatch/middleware/show_exceptions.rb:31:in `call'"
2017-09-13T17:51:38Z D! Grok no match found for: "railties (5.1.4) lib/rails/rack/logger.rb:36:in `call_app'"
2017-09-13T17:51:38Z D! Grok no match found for: "railties (5.1.4) lib/rails/rack/logger.rb:24:in `block in call'"
2017-09-13T17:51:38Z D! Grok no match found for: "activesupport (5.1.4) lib/active_support/tagged_logging.rb:69:in `block in tagged'"
2017-09-13T17:51:38Z D! Grok no match found for: "activesupport (5.1.4) lib/active_support/tagged_logging.rb:26:in `tagged'"
2017-09-13T17:51:38Z D! Grok no match found for: "activesupport (5.1.4) lib/active_support/tagged_logging.rb:69:in `tagged'"
2017-09-13T17:51:38Z D! Grok no match found for: "railties (5.1.4) lib/rails/rack/logger.rb:24:in `call'"
2017-09-13T17:51:38Z D! Grok no match found for: "sprockets-rails (3.2.1) lib/sprockets/rails/quiet_assets.rb:13:in `call'"
2017-09-13T17:51:38Z D! Grok no match found for: "actionpack (5.1.4) lib/action_dispatch/middleware/remote_ip.rb:79:in `call'"
...

Cheers!

2

We don’t have support for multiline parsing right now, you could open a feature request though.

1 Like