According to this suggestion Telegraf logparser output prometheus_client help needed - #2 by daniel
I configured telegraf
[[inputs.logparser]]
files = ["/var/log/mail.log"]
from_beginning = false
[inputs.logparser.grok]
patterns = ["%{SYSLOGAMAVIS} \\([0-9\\-]+\\) \\w+ %{WORD:statusname} %{GREEDYDATA}"]
measurement = "spamassassin_mail"
custom_patterns = '''
AMAVISPROG amavis
SYSLOGAMAVISPROG %{AMAVISPROG}(?:\[%{POSINT}\])?
SYSLOGAMAVIS %{SYSLOGTIMESTAMP} (?:%{SYSLOGFACILITY} )?%{SYSLOGHOST} %{SYSLOGAMAVISPROG}:
timezone = "Local"
'''
[inputs.logparser.tags]
value = "1"
[[processors.converter]]
namepass = ["spamassassin_mail"]
[processors.converter.tags]
integer = ["value"]
[processors.converter.fields]
tag = ["statusname"]
[[aggregators.basicstats]]
namepass = ["spamassassin_mail"]
drop_original = true
period = "30s"
stats = ["sum"]
Log line
Jul 8 01:43:35 mx amavis[12227]: (12227-18) Passed CLEAN {RelayedInbound}, [x.x.x.x]:42538 [y.y.y.y] <no-reply@aaa.bb.ru> -> <zzz@aaa.ru>, Queue-ID: 53662B08A94C, Message-ID: <20180707224332.E3F1B1401AC@sss.bb.ru>, mail_id: lUsZ53IlsaJo, Hits: 4.55, size: 39227, queued_as: 54BE4B08A94D, 1927 ms
Start telegraf
Wait message in mail.log and view the output from telegraf
curl -s http://127.0.0.1:9199/metrics | grep spam
spamassassin_mail_value_sum{host="mx",path="/var/log/mail.log",statusname="CLEAN"} 3
But in a short time this result disappears from telegraf metrics due to the next expected log message and output starts from the beginning
spamassassin_mail_value_sum{host="mx",path="/var/log/mail.log",statusname="CLEAN"} 1
How to fix this, i need growing counter?