Closed
Description
Bug report
Despite being documented as working, you cannot use newlines in the pattern field of logparser
Relevant telegraf.conf:
[[inputs.logparser]]
files = ["/var/log/auth.log"]
from_beginning = false
watch_method = "inotify"
[inputs.logparser.grok]
patterns = ['''
%{SYSLOGTIMESTAMP:timestamp}
''']
System info:
Telegraf 1.5.3
Steps to reproduce:
- Using configuration above parse this data:
Apr 10 05:11:57
Expected behavior:
Line is parsed
Actual behavior:
Line is not matched
Additional info:
Will parse if whitespace is removed:
patterns = ['''%{SYSLOGTIMESTAMP:timestamp}''']