Skip to content

Logparser patterns cannot contain newlines #4004

Closed
@danielnelson

Description

Bug report

Despite being documented as working, you cannot use newlines in the pattern field of logparser

Relevant telegraf.conf:

[[inputs.logparser]]
  files = ["/var/log/auth.log"]
  from_beginning = false
  watch_method = "inotify"
  [inputs.logparser.grok]
    patterns = ['''
        %{SYSLOGTIMESTAMP:timestamp}
    ''']

System info:

Telegraf 1.5.3

Steps to reproduce:

  1. Using configuration above parse this data:
    Apr 10 05:11:57
    

Expected behavior:

Line is parsed

Actual behavior:

Line is not matched

Additional info:

Will parse if whitespace is removed:

patterns = ['''%{SYSLOGTIMESTAMP:timestamp}''']

Metadata

Assignees

No one assigned

    Labels

    bugunexpected problem or unintended behavior

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions