Understand tail input plugin telegraf

Telegraf
,
1

Hi,
i’m trying to diving into tail input plugin.
Right now i’ve configured on my telegraf configuration this snippet:

[[inputs.tail]]
name_override = "accesslog"
files = ["/var/log/httpd/sslaccess_*.log"]
data_format = "grok"
grok_patterns = ['\[%{HTTPDATE:timestamp}\] %{IP:client_ip} %{DATA:tls_version} %{DATA:cipher_suite} \"%{WORD:http_method} %{DATA:request} HTTP/%{NUMBER:http_version}"\ %{NUMBER:status_code} %{NUMBER:response_time}']
from_beginning = true

and it works fine because with test input i’ve this output correctly parsed :

> accesslog,ambiente=fferraro_dev,host=156-t917-sap-pe.ad.fferraro.it,path=/var/log/httpd/sslaccess_areaclienti2.test.pec.fferraro.it_20240715.log cipher_suite="ECDHE-RSA-AES256-GCM-SHA384",client_ip="10.70.12.74",http_method="POST",http_version="1.1",request="/fferraro/rpc/EmailManager",response_time="434903",status_code="451",timestamp="15/Jul/2024:22:00:36 +0200",tls_version="TLSv1.2" 1721136849190576930

> accesslog,ambiente=fferraro_dev,host=156-t917-sap-pe.ad.fferraro.it,path=/var/log/httpd/sslaccess_areaclienti2.test.pec.fferraro.it_20240715.log cipher_suite="ECDHE-RSA-AES256-GCM-SHA384",client_ip="10.70.12.74",http_method="POST",http_version="1.1",request="/fferraro/rpc/EmailManager",response_time="523596",status_code="451",timestamp="15/Jul/2024:22:01:16 +0200",tls_version="TLSv1.2" 1721136849190612749

but now the question is how can i grab from grafana only response_time?
also can i grok only response_time?

Thanks

2

If you only want the field response_time, you can use metric modifiers to exclude all other fields via:

fieldinclude = ["response_time"]

Check out the metric modifiers: telegraf/docs/CONFIGURATION.md at master · influxdata/telegraf · GitHub

3

thanks a lot, i’m searching this.

but now i’ve another problem that i don’t understand.
i’ve set for debug

[[outputs.file]]
files = ["stdout", "/tmp/metrics.out"]

and i’ve only metric for other inputs and not for tail input

system,ambiente=fferraro_dev,host=156-t917-sap-pe.ad.fferraro.it load1=0.01,load5=0.04,load15=0.05,n_cpus=4i,n_users=2i,n_unique_users=1i 1721204250000000000
system,ambiente=fferraro_dev,host=156-t917-sap-pe.ad.fferraro.it uptime=51041182i 1721204250000000000
system,ambiente=fferraro_dev,host=156-t917-sap-pe.ad.fferraro.it uptime_format="590 days, 18:06" 1721204250000000000

but if i test tail input with this command :

telegraf --config-directory=/etc/telegraf --test-wait 50 --input-filter=tail

i’ve correctly output
do you know why telegraf cannot write these metrics from tail input?
Thanks

4

ok maybe i’ve seen where is the problem

i’ve this output

accesslog,ambiente=fferraro_dev,host=156-t917-sap-pe.ad.fferraro.it,path=/var/log/httpd/sslaccess_areaclienti2.test.pec.fferraro.it_20240715.log response_time=“25266” 1721210456151104069

so i’ve a space between path and response_time… maybe that’s the problem?

5

The space separates tags from fields. Check out the following to learn more about the line protocol syntax: Line protocol | InfluxDB Cloud (TSM) Documentation