Telegraf inputs.tail - collect logs only if the line contains a specific string

1

Hello,

I am using telegraf inputs.tail.

Is it possible to configure the telegraf to collect logs only if the line contains a specific string?

2

Hello @eliranm,
Yes you can use:

  #[inputs.tail.multiline]
    ## The pattern should be a regexp which matches what you believe to be an indicator that the field is part of an event consisting of multiple lines of log data.
    #pattern = "^\s"

If you want to use regex to help parse the line, you definitely want to use the grok parser, which is build on regex, and supports regex selectors. Check out the grok documentation for details on that.

3

Thank you for your response.

But I mean, how to filter rows that will be written to InfluxDB.

For example:
I want only a line containing the word “Down” to be written to InfluxDB.

Can you explain to me how to do this?