tail

package
Version: v1.23.3 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jul 25, 2022 License: MIT Imports: 20 Imported by: 6

README

Tail Input Plugin

The tail plugin "tails" a logfile and parses each log message.

By default, the tail plugin acts like the following unix tail command:

tail -F --lines=0 myfile.log
  • -F means that it will follow the name of the given file, so that it will be compatible with log-rotated files, and that it will retry on inaccessible files.
  • --lines=0 means that it will start at the end of the file (unless the from_beginning option is set).

see http://man7.org/linux/man-pages/man1/tail.1.html for more details.

The plugin expects messages in one of the Telegraf Input Data Formats.

Configuration

# Parse the new lines appended to a file
[[inputs.tail]]
  ## File names or a pattern to tail.
  ## These accept standard unix glob matching rules, but with the addition of
  ## ** as a "super asterisk". ie:
  ##   "/var/log/**.log"  -> recursively find all .log files in /var/log
  ##   "/var/log/*/*.log" -> find all .log files with a parent dir in /var/log
  ##   "/var/log/apache.log" -> just tail the apache log file
  ##   "/var/log/log[!1-2]*  -> tail files without 1-2
  ##   "/var/log/log[^1-2]*  -> identical behavior as above
  ## See https://github.com/gobwas/glob for more examples
  ##
  files = ["/var/mymetrics.out"]

  ## Read file from beginning.
  # from_beginning = false

  ## Whether file is a named pipe
  # pipe = false

  ## Method used to watch for file updates.  Can be either "inotify" or "poll".
  # watch_method = "inotify"

  ## Maximum lines of the file to process that have not yet be written by the
  ## output.  For best throughput set based on the number of metrics on each
  ## line and the size of the output's metric_batch_size.
  # max_undelivered_lines = 1000

  ## Character encoding to use when interpreting the file contents.  Invalid
  ## characters are replaced using the unicode replacement character.  When set
  ## to the empty string the data is not decoded to text.
  ##   ex: character_encoding = "utf-8"
  ##       character_encoding = "utf-16le"
  ##       character_encoding = "utf-16be"
  ##       character_encoding = ""
  # character_encoding = ""

  ## Data format to consume.
  ## Each data format has its own unique set of configuration options, read
  ## more about them here:
  ## https://github.com/influxdata/telegraf/blob/master/docs/DATA_FORMATS_INPUT.md
  data_format = "influx"

  ## Set the tag that will contain the path of the tailed file. If you don't want this tag, set it to an empty string.
  # path_tag = "path"

  ## Filters to apply to files before generating metrics
  ## "ansi_color" removes ANSI colors
  # filters = []

  ## multiline parser/codec
  ## https://www.elastic.co/guide/en/logstash/2.4/plugins-filters-multiline.html
  #[inputs.tail.multiline]
    ## The pattern should be a regexp which matches what you believe to be an indicator that the field is part of an event consisting of multiple lines of log data.
    #pattern = "^\s"

    ## The field's value must be previous or next and indicates the relation to the
    ## multi-line event.
    #match_which_line = "previous"

    ## The invert_match can be true or false (defaults to false).
    ## If true, a message not matching the pattern will constitute a match of the multiline filter and the what will be applied. (vice-versa is also true)
    #invert_match = false

    #After the specified timeout, this plugin sends the multiline event even if no new pattern is found to start a new event. The default is 5s.
    #timeout = 5s

Metrics

Metrics are produced according to the data_format option. Additionally a tag labeled path is added to the metric containing the filename being tailed.

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type Multiline added in v1.16.0

type Multiline struct {
	// contains filtered or unexported fields
}

func (*Multiline) Flush added in v1.16.0

func (m *Multiline) Flush(buffer *bytes.Buffer) string

func (*Multiline) IsEnabled added in v1.16.0

func (m *Multiline) IsEnabled() bool

func (*Multiline) ProcessLine added in v1.16.0

func (m *Multiline) ProcessLine(text string, buffer *bytes.Buffer) string

type MultilineConfig added in v1.16.0

type MultilineConfig struct {
	Pattern        string
	MatchWhichLine MultilineMatchWhichLine `toml:"match_which_line"`
	InvertMatch    bool
	Timeout        *config.Duration
}

func (*MultilineConfig) NewMultiline added in v1.16.0

func (m *MultilineConfig) NewMultiline() (*Multiline, error)

type MultilineMatchWhichLine added in v1.16.0

type MultilineMatchWhichLine int

Indicates relation to the multiline event: previous or next

const (
	// Previous => Append current line to previous line
	Previous MultilineMatchWhichLine = iota
	// Next => Next line will be appended to current line
	Next
)

func (MultilineMatchWhichLine) MarshalText added in v1.16.0

func (w MultilineMatchWhichLine) MarshalText() ([]byte, error)

MarshalText implements encoding.TextMarshaler

func (MultilineMatchWhichLine) String added in v1.16.0

func (w MultilineMatchWhichLine) String() string

func (*MultilineMatchWhichLine) UnmarshalTOML added in v1.16.0

func (w *MultilineMatchWhichLine) UnmarshalTOML(data []byte) (err error)

UnmarshalTOML implements ability to unmarshal MultilineMatchWhichLine from TOML files.

func (*MultilineMatchWhichLine) UnmarshalText added in v1.16.0

func (w *MultilineMatchWhichLine) UnmarshalText(data []byte) (err error)

UnmarshalText implements encoding.TextUnmarshaler

type Tail

type Tail struct {
	Files               []string `toml:"files"`
	FromBeginning       bool     `toml:"from_beginning"`
	Pipe                bool     `toml:"pipe"`
	WatchMethod         string   `toml:"watch_method"`
	MaxUndeliveredLines int      `toml:"max_undelivered_lines"`
	CharacterEncoding   string   `toml:"character_encoding"`
	PathTag             string   `toml:"path_tag"`

	Filters []string `toml:"filters"`

	Log telegraf.Logger `toml:"-"`

	MultilineConfig MultilineConfig `toml:"multiline"`
	// contains filtered or unexported fields
}

func NewTail

func NewTail() *Tail

func (*Tail) Gather

func (t *Tail) Gather(_ telegraf.Accumulator) error

func (*Tail) Init added in v1.15.0

func (t *Tail) Init() error

func (*Tail) SampleConfig

func (*Tail) SampleConfig() string

func (*Tail) SetParserFunc

func (t *Tail) SetParserFunc(fn parsers.ParserFunc)

func (*Tail) Start

func (t *Tail) Start(acc telegraf.Accumulator) error

func (*Tail) Stop

func (t *Tail) Stop()

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL