Snmp processors.regex error and proper format

Telegraf
1

Having issues with my formatting of the regex for splitting out the log-dates format to a more readable format.

Here is what the data looks like: log-dates=“20230614204828.000000-360”

I’m actually using this in conjunction with a Grafana dashboard. Here is the original link (iDRAC - Host Stats | Grafana Labs)

It has the following:

[[processors.regex]]
   [[processors.regex.fields]]
     key = "log-dates"
     pattern = "^(?P\d{4})(?P\d{2})(?P\d{2})(?P\d{2})(?P\d{2})(?P\d{2})\.(?P\d{6})(?P[-+]\d{3,4})$"
     replacement = "${YYYY}-${MM}-${DD} ${HH}:${mm}:${ss}"

When I try and use this I get a toml format error on the replacement line. So I modified it as below and I get no errors; however, I 'm in the output log I’m not seeing the modifications.

[[processors.regex]]
  [[processors.regex.fields]]
    key = "log-dates"
    pattern = '^(?P<YYYY>\\d{4})(?P<MM>\\d{2})(?P<DD>\\d{2})(?P<HH>\\d{2})(?P<mm>\\d{2})(?P<ss>\\d{2})\\.(?P<msec>\\d{6})(?P<tz>[-+]?\\d{3,4})$'
    replacement = '${YYYY}-${MM}-${DD} ${HH}:${mm}:${ss}'

I’m not the best at regex and was wondering if someone could assist.

2

When using a single quote, you don’t need to escape the slashes.

So either you put this:

pattern = '^(?P<YYYY>\d{4})(?P<MM>\d{2})(?P<DD>\d{2})(?P<HH>\d{2})(?P<mm>\d{2})(?P<ss>\d{2})\.(?P<msec>\d{6})(?P<tz>[-+]?\d{3,4})$'

or like this:

pattern = "^(?P<YYYY>\\d{4})(?P<MM>\\d{2})(?P<DD>\\d{2})(?P<HH>\\d{2})(?P<mm>\\d{2})(?P<ss>\\d{2})\\.(?P<msec>\\d{6})(?P<tz>[-+]?\\d{3,4})$"

Also see this for testing regex: regex101: build, test, and debug regex

3

@c-stewa20 alternatively, the timestamp processor might also be helpful…

1 Like