Telegram - How to use timestamps from data with tail / grok

Hi all,

I’ve set up a nice little grok parse that works fine except for one thing: I can’t get the timestamp imported from the actual data.

My data has a timestamp in epoch format and three float values - like this:


My telegraf config including grok pattern is:
files = ["/mnt/log/data.csv"]
data_format = “grok”
from_beginning = false
name_suffix = “_logdata”
grok_patterns = [’%{NUMBER:timestamp:ts},%{NUMBER:value1:float},%{NUMBER:value2:float},%{NUMBER:value3:float}’]

It works fine now except for the timestamp parse - I find the timestamp column in my influxdb, but not as actual timestamp of the data, rather as a field. So the first import with “from_beginning = true” puts all records into the db under the timestamp of the import, and only continuous run fills it later as a proper time sequence of data points.

Is there a way to do this? The documentation of inputs.tail didn’t help me, or maybe I just didn’t find the right section - would be grateful for any tips.


@sydrooz I believe your grok patterns should be:

- grok_patterns = [’%{NUMBER:timestamp:ts},%{NUMBER:value1:float},%{NUMBER:value2:float},%{NUMBER:value3:float}’]
+ grok_patterns = [’%{TIMESTAMP:timestamp:ts},%{NUMBER:value1:float},%{NUMBER:value2:float},%{NUMBER:value3:float}’]

Hi scott,

Thanks for your reply, on that I just get:

Creating parser: no pattern found for %{TIMESTAMP}


Hello @sydrooz,
Have you tried using:
to make sure that your output is in line protocol?