1

Applies to configuration: Logging processors

This setup works:

/etc/google-cloud-ops-agent/config.yaml

logging:
  receivers:
    app:
      type: files
      include_paths: [/www/logs/app-*.log]
  processors:
    monolog:
      type: parse_regex
      field: message
      regex: "^\[(?<time>[^\]]+)\]\s+(?<environment>\w+)\.(?<severity>\w+):\s+(?<msg>.*?)(?<context>{.*})?\s*$"
  service:
    pipelines:
      default_pipeline:
        receivers: [app]
        processors: [monolog]

I am trying to configure time_key, but the logs do not show up in the log viewer. I call the API whether the logs are being processed, whether they are read and sent. They come out but are not in the log viewer.

logging:
  receivers:
    app:
      type: files
      include_paths: [/www/logs/app-*.log]
  processors:
    monolog:
      type: parse_regex
      field: message
      regex: "^\[(?<time>[^\]]+)\]\s+(?<environment>\w+)\.(?<severity>\w+):\s+(?<msg>.*?)(?<context>{.*})?\s*$"
      time_key:    time
      time_format: "%Y-%m-%d %H:%M:%S"
  service:
    pipelines:
      default_pipeline:
        receivers: [app]
        processors: [monolog]

Log structure:

[2021-10-06 12:12:08] production.EMERGENCY: Testing {"abc":"xyz"}

Parsed (first code example):

{
  jsonPayload: {
    context: "{"abc":"xyz"}"
    environment: "production"
    msg: "Testing "
    severity: "EMERGENCY"
    time: "2021-10-06 12:12:08"
  }
}

API call to check logs processed:

curl -s localhost:2020/api/v1/metrics | jq

From strptime(3) also tried to use "%F %H:%M:%S"

What am I doing wrong?

Gander
  • 1,854
  • 1
  • 23
  • 30
  • Hi @Gander. Did you get this working? I am working on the similar matter and checking how to parse e.g. severity information based on my namespace and nodejs debug module inputs. Saw also this one from Google, which is fix related to the topic without ETA: https://issuetracker.google.com/issues/202309453?pli=1 – Matti Vilola Apr 25 '22 at 15:58
  • 1
    @MattiVilola Unfortunately not. Also, it is no longer my interest to find an answer to this as I don't work with it anymore. – Gander Apr 25 '22 at 20:35

0 Answers0