1

I am trying to import tomcat catalina logs line by line, I am using telegraf tail plugin with a grok pattern.

telegraf.conf

[[inputs.tail]]
  ## file(s) to tail:
  files = ["/u/app/tc/TOMCAT/instances/T/logs/catalina.log"]
  from_beginning = false
  name_override = "test_metric"
  pipe = false
  ## For parsing logstash-style "grok" patterns :
  data_format = "grok"
  grok_patterns = ["%{GREEDYDATA:log_line:string}"]

[[outputs.file]]
  ## Files to write to, "stdout" is a specially handled file.
  files = ["/tmp/metrics.out"]

The above conf is writing the logs from catalina.log to metrics.out line by line, but its also throwing an error along with it.

Error :

2020-06-22T17:52:25Z E! Error in plugin [inputs.tail]: E! Malformed log line in /u/app/tc/TOMCAT/instances/T/logs/catalina.log: [], Error: grok: must have one or more fields
2020-06-22T17:52:25Z E! Error in plugin [inputs.tail]: E! Malformed log line in /u/app/tc/TOMCAT/instances/T/logs/catalina.log: [], Error: grok: must have one or more fields

Is this coz of the grok_patterns have some mistake ?

Thank you.

Kris
  • 33
  • 1
  • 1
  • 6

1 Answers1

0

That was fixed by changing the value of data_format = "grok" to data_format = "value"

Kris
  • 33
  • 1
  • 1
  • 6