Hi, Thanks for the suggestions and I will review reducing the tags by leveraging the fields. We have added few additional tags and fields, please ignore them.
On the syslog plugin problem of getting the metrics I tried out the syslog debugging 2
Below are the output of various timestamp formats supplied through netcat with syslog_standard = “RFC3164” set in plugin configuration
$ echo “<13>1 2018-10-01T12:00:00.0Z example.org root - - - test” | nc -u 127.0.0.1 6514
2022-09-30T10:09:18Z E! [inputs.syslog] Error in plugin: expecting a Stamp timestamp [col 4]
$ echo “<13>1 Oct 11 22:14:15 example.org root - - - test” | nc -u 127.0.0.1 6514
2022-09-30T10:12:23Z E! [inputs.syslog] Error in plugin: expecting a Stamp timestamp [col 4]
$ echo “<13>Sep 30 06:14:15 example.org root - - - test” | nc -u 127.0.0.1 6514
<No error and no output>
I did try the nc message by setting syslog_standard = “RFC5424” and passed the below message, this time the metric data was outputted and no error log.
$ echo “<13>1 2018-10-01T12:00:00.0Z example.org root - - - test” | nc -u 127.0.0.1 6514
syslog,appname=root,facility=user,facility_code=1,hoster=na,hostname=example.org,label=root_notice,message=test,severity=notice,severity_code=5,source=127.0.0.1,timestamp=1538395200000000000,version=1 Nb=1i 1664533543165555253
Based on the debugging results I suppose the problem might be with RFC3164 parser. Any thoughts?
Please note that I have upgraded the telegraf version to 1.24.1 and the above tests are conducted in this version of binary.
