# Telegraf logparser, prometheus\_client drops metrics

**URL:** <https://community.influxdata.com/t/telegraf-logparser-prometheus-client-drops-metrics/5852>\
**Category:** Telegraf\
**Tags:** telegraf, prometheus\
**Created:** [July 11, 2018, 11:00am UTC](https://community.influxdata.com/t/telegraf-logparser-prometheus-client-drops-metrics/5852 "2018-07-11T11:00:15Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![supar](https://avatars.discourse-cdn.com/v4/letter/s/e56c9b/32.png) [@supar](https://community.influxdata.com/u/supar)\
**Post date:** [July 11, 2018, 11:00am UTC](https://community.influxdata.com/t/telegraf-logparser-prometheus-client-drops-metrics/5852/1 "2018-07-11T11:00:15Z")

</div>

According to this suggestion [Telegraf logparser output prometheus\_client help needed - #2 by daniel](https://community.influxdata.com/t/telegraf-logparser-output-prometheus-client-help-needed/5338/2)

I configured telegraf

```
[[inputs.logparser]]
  files = ["/var/log/mail.log"]
  from_beginning = false
  [inputs.logparser.grok]
      patterns = ["%{SYSLOGAMAVIS} \\([0-9\\-]+\\) \\w+ %{WORD:statusname} %{GREEDYDATA}"]
      measurement = "spamassassin_mail"

      custom_patterns = '''
          AMAVISPROG amavis
          SYSLOGAMAVISPROG %{AMAVISPROG}(?:\[%{POSINT}\])?
          SYSLOGAMAVIS %{SYSLOGTIMESTAMP} (?:%{SYSLOGFACILITY} )?%{SYSLOGHOST} %{SYSLOGAMAVISPROG}:

          timezone = "Local"
      '''
    [inputs.logparser.tags]
        value = "1"

[[processors.converter]]
  namepass = ["spamassassin_mail"]
  [processors.converter.tags]
    integer = ["value"]
  [processors.converter.fields]
    tag = ["statusname"]

[[aggregators.basicstats]]
  namepass = ["spamassassin_mail"]
  drop_original = true
  period = "30s"
  stats = ["sum"]

```

Log line

```
Jul 8 01:43:35 mx amavis[12227]: (12227-18) Passed CLEAN {RelayedInbound}, [x.x.x.x]:42538 [y.y.y.y] <no-reply@aaa.bb.ru> -> <zzz@aaa.ru>, Queue-ID: 53662B08A94C, Message-ID: <20180707224332.E3F1B1401AC@sss.bb.ru>, mail_id: lUsZ53IlsaJo, Hits: 4.55, size: 39227, queued_as: 54BE4B08A94D, 1927 ms

```

Start telegraf  
Wait message in mail.log and view the output from telegraf

```
curl -s http://127.0.0.1:9199/metrics | grep spam
spamassassin_mail_value_sum{host="mx",path="/var/log/mail.log",statusname="CLEAN"} 3

```

But in a short time this result disappears from telegraf metrics due to the next expected log message and output starts from the beginning

```
spamassassin_mail_value_sum{host="mx",path="/var/log/mail.log",statusname="CLEAN"} 1

```

How to fix this, i need growing counter?

---

<div class="post-metadata">

**Author:** ![daniel](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/daniel/32/142_2.png) [@daniel](https://community.influxdata.com/u/daniel)\
**Post date:** [July 12, 2018, 12:19am UTC](https://community.influxdata.com/t/telegraf-logparser-prometheus-client-drops-metrics/5852/2 "2018-07-12T00:19:30Z")

</div>

I think we would need a new processor to turn reseting counters into non-reseting counters. You could open a new issue on the Telegraf issue tracker.