# Telegraf tail-plugin with grok: no data written to influxdb

**URL:** <https://community.influxdata.com/t/telegraf-tail-plugin-with-grok-no-data-written-to-influxdb/27393>\
**Category:** Telegraf\
**Tags:** influxdb, grok, tail\
**Created:** [November 16, 2022, 11:52am UTC](https://community.influxdata.com/t/telegraf-tail-plugin-with-grok-no-data-written-to-influxdb/27393 "2022-11-16T11:52:02Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![astrakid](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/astrakid/32/6917_2.png) [@astrakid](https://community.influxdata.com/u/astrakid)\
**Post date:** [November 16, 2022, 11:52am UTC](https://community.influxdata.com/t/telegraf-tail-plugin-with-grok-no-data-written-to-influxdb/27393/1 "2022-11-16T11:52:02Z")

</div>

hi,  
i am parsing an sftp-log for certain requests. if matched an entry should be written in influxdb.

this is my telegraf-conf:

```auto
  files = ["/var/log/proftpd/sftp.log"]
  watch_method = "inotify"
  from_beginning = true

grok_timezone = "Europe/Berlin"
data_format = "grok"
grok_patterns = ["%{CUSTOM_LOG}"]
grok_custom_patterns = '''
CUSTOM_LOG %{DATE:date}.%{TIME:time}\,[0-9]{3} .* requested read offset .* greater.than.size.of.\'\/%{GREEDYDATA:iosversion:tag}\/lxos.inf.*
'''

```

a match looks like this:

```auto
> tail,host=big-vtransfer02,iosversion=IGEL_OS_11-11.08.110,path=/var/log/proftpd/sftp.log date="22-11-16",num=1i,time="08:41:31" 1668599461271264300

```

but i don’t see any data in influxdb.  
what is wrong?

regards,  
andre

---

<div class="post-metadata">

**Author:** ![jpowers](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/jpowers/32/8569_2.png) [@jpowers](https://community.influxdata.com/u/jpowers)\
**Post date:** [November 16, 2022, 1:34pm UTC](https://community.influxdata.com/t/telegraf-tail-plugin-with-grok-no-data-written-to-influxdb/27393/2 "2022-11-16T13:34:08Z")

</div>

> [@astrakid](#):
>
> what is wrong?

You are going to need to provide some logs from Telegraf, ideally with debug mode on. It should have an entry where it says it “wrote {#} metric” to influxdb or something similar. That would confirm that it is at least writing data to influxdb.

---

<div class="post-metadata">

**Author:** ![Giovanni\_Luisotto](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/giovanni_luisotto/32/4017_2.png) [@Giovanni\_Luisotto](https://community.influxdata.com/u/Giovanni_Luisotto)\
**Post date:** [November 16, 2022, 1:56pm UTC](https://community.influxdata.com/t/telegraf-tail-plugin-with-grok-no-data-written-to-influxdb/27393/3 "2022-11-16T13:56:23Z")

</div>

Have you tried with other `watch_method` _(“inotify” or “poll”)_?

I’m on Windows and only `poll` works for me, just try it out and see if that’s the case for you too.

---

<div class="post-metadata">

**Author:** ![astrakid](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/astrakid/32/6917_2.png) [@astrakid](https://community.influxdata.com/u/astrakid)\
**Post date:** [November 17, 2022, 6:09am UTC](https://community.influxdata.com/t/telegraf-tail-plugin-with-grok-no-data-written-to-influxdb/27393/4 "2022-11-17T06:09:04Z")

</div>

yes, that worked! thanks. in poll mode data is written to influxdb.

do you know how to write a “1” into influxdb if my grok pattern matches? currently the date is written, which i don’t need. i can remove it from my grok, but how to enter a static value?

---

<div class="post-metadata">

**Author:** ![astrakid](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/astrakid/32/6917_2.png) [@astrakid](https://community.influxdata.com/u/astrakid)\
**Post date:** [November 17, 2022, 6:47am UTC](https://community.influxdata.com/t/telegraf-tail-plugin-with-grok-no-data-written-to-influxdb/27393/5 "2022-11-17T06:47:15Z")

</div>

did it with processors.enum.mapping:

```auto
[[processors.enum]]
  [[processors.enum.mapping]]
    field = "lxos.inf"
    dest = "num"
    [processors.enum.mapping.value_mappings]
    "lxos.inf" = 1

```