Need help with logparser

Telegraf
1

Hi
I tried to set up a log parser on nginx response code and while first initial tries failed, I now receive an error incomprehensible to me. Here are some details:
Influx Version: influxdb-1.7.9-1.x86_64
Teelgraf Version: Telegraf 1.13.1 (git: HEAD 0c175724)

The config gist:

Blockquote
[[inputs.logparser]]
files = [“/var/log/nginx/access.log”]
from_beginning = true
watch_method = “inotify”
[inputs.logparser.grok]
patterns = [“%{METRICS_INCLUDE_RESPONSE}”]
measurement = “nginx_access_log”
custom_patterns = ‘’’
METRICS_INCLUDE_RESPONSE [%{NUMBER:response}]
‘’’

The error I receive is:
2020-02-05T07:33:42Z E! [inputs.logparser] Error parsing log line: error parsing regexp: unexpected ): ([(?P<response>(?:(([+-]?(?:[0-9]+(?:\.[0-9]+)?)|\.[0-9]+))))])

Appreciate to let me know what part needs change or modification…I am a newbie in the world of log parsing really Thank you again

2

I think you need to escape the brackets in your custom pattern, since brackets are special characters for the regular expressions.

METRICS_INCLUDE_RESPONSE \[%{NUMBER:response}\]

To explain the error message a bit, each pattern such as %{NUMBER:response}, is just a placeholder for a regular expression. In this case it is replaced with (?P<response>(?:(([+-]?(?:[0-9]+(?:\.[0-9]+)?)|\.[0-9]+)))). If you add the brackets around this regular expression then it is no longer valid.