Telegraf Input File Plugin does not support grok and json both logs parsing in single logs

Telegraf
, ,
1

Hi,
I have an input String in my file

2023-10-17T14:04:51.429439018Z stdout F {"timeMillis":1697551491429,"thread":"http-nio-8081-exec-4","level":"DEBUG","loggerName":"org.apache.tomcat.util.http.Parameters","message":"Set encoding to UTF-8","endOfBatch":false,"loggerFqcn":"java.util.logging.Logger","threadId":27,"threadPriority":5,"timestamp":"2023-10-17T14:04:51.429+0000","X-Correlation-ID":"1697551344764-3608db2f-acb1-4bd4-85d4-0cdefce0e7b6"}

It has text as well as json log in the single file.
I have applied grok to filter json logs in a separate tag but I am not able to further parse this json log.
Please help me to sort this thing out.
Input plugin configuration:

[[inputs.file]]
files = [“/var/log/containers/cms-service*”]
data_format = “grok”
grok_patterns = [‘%{TIMESTAMP_ISO8601:log_timestamp} %{DATA:log_source} %{WORD:log_level} %{GREEDYDATA:log}’]
file_tag = “filepath”

or suggest me any processor plugin to parse json logs

Thanks in advance

2

@Vivek_parody I would try the parser processor as it does what the name suggests… :stuck_out_tongue_winking_eye:

Simply point it to the log field of your metric and configure the JSON parsing…

1 Like
3

Thanks @srebhan for your response, Its working fine :blush:

1 Like