Telegraf inputs.tail.tagpass trouble

Telegraf
1

OpcClient20250506.log:
2025-05-07 08:23:19.736 +02:00 [VRB] Handler try read state did not succeeded, “TargetPortNotFound”
2025-05-07 08:23:19.667 +02:00 [ERR] Error 2 Opc Control could not send PING to Port

[[inputs.tail]]
files = [“c:\logs\OpcClient20250506.log”]
name_override = “opc_client_log”
data_format = “grok”
from_beginning = true # Deprecated in 1.34, replace with initial_read_offset if needed
grok_patterns = [‘^%{TIMESTAMP_ISO8601:timestamp} [%{WORD:level}] %{GREEDYDATA:message}’]
grok_timezone = “Local”
grok_custom_patterns = ‘’’
TIMESTAMP_ISO8601 %{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND}.%{INT} %{ISO8601_TIMEZONE}
‘’’

[inputs.tail.tagdrop]
level = [“VRB”, “DBG”, “INF”, “WRN”] # Drops everything except ERR

[[outputs.influxdb_v2]]
urls = [“http://localhost:8086”]

1:
I have the above setup it is working, instead of tagdrop I would like:
#[inputs.tail.tagpass]

level = [“ERR”] # Only pass ERR

But I cant make it work.
2:
There is insert 3 _fields in the Influx DB: timestamp, level and message, I would prefer only one.
Timestamp should be _time in the Influx DB
level not logged
message the Influx _Value
/mads

2

@MadsE Welcome to the Influxdata community!

The key difference with tagpass is that it will only pass metrics that match the specified tag values, while tagdrop drops metrics that match the specified tag values.

For your second issue about having only one field in the InfluxDB, you can use the processors.converter plugin to manage your fields.

Your final configuration should look like this:

[[inputs.tail]]
files = ["c:\\logs\\OpcClient20250506.log"]
name_override = "opc_client_log"
data_format = "grok"
from_beginning = true
grok_patterns = ['^%{TIMESTAMP_ISO8601:timestamp} [%{WORD:level}] %{GREEDYDATA:message}']
grok_timezone = "Local"
grok_custom_patterns = '''
TIMESTAMP_ISO8601 %{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:%{MINUTE}:%{SECOND}.%{INT} %{ISO8601_TIMEZONE}
'''

[inputs.tail.tagpass]
level = ["ERR"]  # Only pass ERR level logs

[[processors.converter]]
  namepass = ["opc_client_log"]
  [processors.converter.fields]
    timestamp = "string"

[[processors.date]]
  namepass = ["opc_client_log"]
  field_key = "timestamp"
  timezone = "Local"
  date_format = "2006-01-02 15:04:05.000 -07:00"

[[processors.rename]]
  namepass = ["opc_client_log"]
  [[processors.rename.field]]
    from = "message"
    to = "value"

[[processors.starlark]]
  namepass = ["opc_client_log"]
  source = '''
def apply(metric):
    metric.fields = {"value": metric.fields["value"]}
    return metric
'''

[[outputs.influxdb_v2]]
urls = ["http://localhost:8086"]
3

Hi skartikey
Thank you for the reply, I get errors when I try your script, a little confusing I get different errors when i run it two times, do you have any suggestions?
PS C:\DB\telegraf\telegraf-1.34.2> .\telegraf --config opc_telegraf.conf --debug
2025-05-13T07:59:54Z I! Loading config: opc_telegraf.conf
2025-05-13T07:59:54Z W! DeprecationWarning: Option “from_beginning” of plugin “inputs.tail” deprecated since version 1.34.0 and will be removed in 1.40.0: use ‘initial_read_offset’ with value ‘beginning’ instead
2025-05-13T07:59:54Z E! loading config file opc_telegraf.conf failed: plugin processors.rename: line 28: configuration specified the fields [“field”], but they were not used. This is either a typo or this config option does not exist in this version.
PS C:\DB\telegraf\telegraf-1.34.2>

The OpcClient20250506.log look like this:
2025-05-07 08:23:03.662 +02:00 [VRB] TwinCAT_Handler 172.21
2025-05-07 08:23:04.646 +02:00 [ERR] Error 1 OpcAds Control
2025-05-07 08:23:19.736 +02:00 [VRB] TwinCAT_Handler 172.21
2025-05-07 08:23:19.667 +02:00 [ERR] Error 2 OpcAds Control
2025-05-07 08:23:20.742 +02:00 [VRB] TwinCAT_Handler 172.22
2025-05-07 08:23:35.667 +02:00 [ERR] Error 3 OpcAds Control
2025-05-07 08:23:45.667 +02:00 [ERR] Error 4 OpcAds Control
2025-05-07 08:23:51.667 +02:00 [ERR] Error 5 OpcAds Control
2025-05-07 08:23:51.667 +02:00 [ERR] Error 6 OpcAds Control
2025-05-07 08:23:20.742 +02:00 [VRB] TwinCAT_Handler 172.24
2025-05-07 08:23:51.667 +02:00 [ERR] Error 7 OpcAds Control