Timestamp format error

1

Hi,

I’m trying to parse a log file with entries (lines) like this:

2017-12-11 11:11:33,591 successfulMatches=1

My telegraf.conf looks like this:

[[inputs.logparser]]
files = ["example.log"]
from_beginning = false
[inputs.logparser.grok]
	patterns = ['%{TIMESTAMP_ISO8601:timestamp:ts-"2006-01-02 15:04:05,000"} successfulMatches=%{NUMBER:successfulMatches:int}']

With this, I get the following output:

2017-12-11T11:11:31Z I! Starting Telegraf v1.4.0
2017-12-11T11:11:31Z I! Loaded outputs: file
2017-12-11T11:11:31Z I! Loaded inputs: inputs.logparser
2017-12-11T11:11:31Z I! Tags enabled: host=PC1
2017-12-11T11:11:31Z I! Agent Config: Interval:10s, Quiet:false, Hostname:"PC1", Flush Interval:10s
2017-12-11T11:11:33Z E! Error parsing 2017-12-11 11:11:33,591 to time layout [2006-01-02 15:04:05,000]: parsing 
time "2017-12-11 11:11:33,591" as "2006-01-02 15:04:05,000": cannot parse "591" as ",000"
logparser_grok,host=PC1,path=example.log successfulMatches=1i 1512990693592554600

Unfortunately I don’t know how to get rid of the parsing error. I cannot do anything about the logfile formatting, because the logfile is written by some third party application. Do I have to use a different custom format string in my telegraf.conf?

Cheers,
Alex

2

I think it is not possible to parse a date that uses a comma to separate out the fractional seconds in Go. There is a issue open to add support for this but it doesn’t seem to be making much progress.

We could probably add a workaround for this into Telegraf, where we substitute dot for comma before parsing, can you open a new issue?

3

Thank you for the hints.

New issue can be found here:
https://github.com/influxdata/telegraf/issues/3571