Logparser: add "filename" tag to each metric for logfile differentiation when using globs

[deveth0]

Feature Request

With #1434 the very useful functionality to add a measurement per logparser grok block was added.

Proposal:

I suggest to extend this with some kind of wildcard or additional setting that would allow to add a measurement per parsed input file.

Desired behavior:

Example:
I've got ~20 different log-files in my nginx (one per vhost) that are parsed using a **access.log expression. It would be very helpful to have one measurement per file.

Of course I could add 20 grok blocks but as soon as I add or remove a vhost this will break.
Opening a feature request kicks off a discussion.

[sparrc]

I think that adding a tag of the filename would be preferrable, and would give you the necessary separation.

[deveth0]

even better, yeah!

[ollybee]

Instead of creating a tag on the filename it would be better to create one on on the wildcard. the file name may not be variable but the wildcard is by definition. The tag would then still be useful in this case:

glob:
/var/log/*/access.log
paths:
/var/log/site1/access.log
/var/log/site2/access.log

[danielnelson]

@ollybee @deveth0 Does this look in line with what you expected?

[[inputs.logparser]]
  files = ["/tmp/*.log"]
  from_beginning = true
  [inputs.logparser.grok]
    patterns = ["%{NUMBER:value:float}"]

$ ls -1 /tmp/*.log
/tmp/a.log
/tmp/b.log

logparser_grok,path=/tmp/b.log value=1000 1502139594221126968
logparser_grok,path=/tmp/a.log value=42 1502139594221371694

[deveth0]

Awesome!

…

On Mon, Aug 7, 2017, 23:04 Daniel Nelson ***@***.***> wrote: @ollybee <https://github.com/ollybee> @deveth0 <https://github.com/deveth0> Does this look in line with what you expected? [[inputs.logparser]] files = ["/tmp/*.log"] from_beginning = true [inputs.logparser.grok] patterns = ["%{NUMBER:value:float}"] $ ls -1 /tmp/*.log /tmp/a.log /tmp/b.log logparser_grok,path=/tmp/b.log value=1000 1502139594221126968 logparser_grok,path=/tmp/a.log value=42 1502139594221371694 — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#2150 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABo5f4V33Wgs-D7ICBxeYcDO5y1v5rz6ks5sV3vPgaJpZM4LLvsF> .

[danielnelson]

Will be included in 1.4 release.