Tail plugin + grafana logs

[phpaiva]

Please direct all support questsions to slack or the forums. Thank you.

I am leaving the issue here because https://community.influxdata.com/ seems to be broken and I cannot login:

So here it goes...

I want to send grafana logs to influxDB for nothing seems to work. No errors are being triggered, the current config file is:

[global_tags]
[agent]
  interval = "120s"
  round_interval = true
  metric_batch_size = 1000
  metric_buffer_limit = 10000
  collection_jitter = "0s"
  flush_interval = "120s"
  flush_jitter = "0s"
  precision = "0s"

# CONFIGURACION DE LA INFLUXDB

[[outputs.influxdb_v2]]
    urls = ["http://192.168.3.56:8086"]
    token = "uLdH_rC1K5EpO6eFmGHRhBzRTdI4t8oBWHqFDxyIOsrN9-RG_lfHYJR_vTb4oR6o1u9KbK57-iR4siVq_jBleA=="
    organization = "Paicorp"
    bucket = "infra_info"

[[inputs.cpu]]
  percpu = true
  totalcpu = true
  collect_cpu_time = false
  report_active = false
  core_tags = false

[[inputs.disk]]
  ignore_fs = ["tmpfs", "devtmpfs", "devfs", "iso9660", "overlay", "aufs", "squashfs"]

[[inputs.diskio]]
[[inputs.kernel]]
[[inputs.mem]]
[[inputs.processes]]
[[inputs.swap]]
[[inputs.system]]

# LOGS DE ACCESO HTTP
[[inputs.tail]]

    files = ["/mnt/ram_logs/horus_sbi.log", "/mnt/ram_logs/horus_nbi.log", "/mnt/ram_logs/horus_gui.log"]

    data_format = "grok"

    name_override = "horus_http_access_logs"

# LOGS DE GRAFANA (HERE IS THE ISSUE)

[[inputs.tail]]

    files = ["/var/log/grafana/grafana.log"]
    data_format = "grok"
    
    grok_patterns = [
        "%{WORD:logger} userId=%{INT:userId} orgId=%{INT:orgId} uname=%{WORD:uname} t=%{TIMESTAMP_ISO8601:timestamp} level=%{LOGLEVEL:level} msg=%{GREEDYDATA:msg} method=%{WORD:method} path=%{URIPATH:path} status=%{INT:status} remote_addr=%{IPV4:remote_addr} time_ms=%{INT:time_ms} duration=%{NUMBER:duration} size=%{INT:size} referer=%{URIPATH:referer} handler=%{URIPATH:handler}"
    ]

    name_override = "grafana_logs"

I only have problems with "/var/log/grafana/grafana.log", which involves this part:

# LOGS DE GRAFANA (HERE IS THE ISSUE)

[[inputs.tail]]

    files = ["/var/log/grafana/grafana.log"]
    data_format = "grok"
    
    grok_patterns = [
        "%{WORD:logger} userId=%{INT:userId} orgId=%{INT:orgId} uname=%{WORD:uname} t=%{TIMESTAMP_ISO8601:timestamp} level=%{LOGLEVEL:level} msg=%{GREEDYDATA:msg} method=%{WORD:method} path=%{URIPATH:path} status=%{INT:status} remote_addr=%{IPV4:remote_addr} time_ms=%{INT:time_ms} duration=%{NUMBER:duration} size=%{INT:size} referer=%{URIPATH:referer} handler=%{URIPATH:handler}"
    ]

    name_override = "grafana_logs"

The other logs (["/mnt/ram_logs/horus_sbi.log", "/mnt/ram_logs/horus_nbi.log", "/mnt/ram_logs/horus_gui.log") are being reported well (guinicorn logs). The service status seems to be OK.

pablo@pablo-MII-V:~$ sudo systemctl status telegraf.service
● telegraf.service - Telegraf
     Loaded: loaded (/lib/systemd/system/telegraf.service; enabled; vendor preset: enabled)
     Active: active (running) since Sun 2025-01-26 18:24:05 -03; 56s ago
       Docs: https://github.com/influxdata/telegraf
   Main PID: 30667 (telegraf)
      Tasks: 10 (limit: 4403)
     Memory: 34.7M
     CGroup: /system.slice/telegraf.service
             ├─30667 /usr/bin/telegraf -config /etc/telegraf/telegraf.conf -config-directory /etc/telegraf/telegraf.d
             └─30677 /usr/bin/dbus-daemon --syslog --fork --print-pid 4 --print-address 6 --session

ene 26 18:24:05 pablo-MII-V telegraf[30667]: 2025-01-26T21:24:05Z I! Available plugins: 236 inputs, 9 aggregators, 33 processors, 26 parsers, 63 outpu>
ene 26 18:24:05 pablo-MII-V telegraf[30667]: 2025-01-26T21:24:05Z I! Loaded inputs: cpu disk diskio kernel mem processes swap system tail (2x)
ene 26 18:24:05 pablo-MII-V telegraf[30667]: 2025-01-26T21:24:05Z I! Loaded aggregators:
ene 26 18:24:05 pablo-MII-V telegraf[30667]: 2025-01-26T21:24:05Z I! Loaded processors:
ene 26 18:24:05 pablo-MII-V telegraf[30667]: 2025-01-26T21:24:05Z I! Loaded secretstores:
ene 26 18:24:05 pablo-MII-V telegraf[30667]: 2025-01-26T21:24:05Z I! Loaded outputs: influxdb_v2
ene 26 18:24:05 pablo-MII-V telegraf[30667]: 2025-01-26T21:24:05Z I! Tags enabled: host=pablo-MII-V
ene 26 18:24:05 pablo-MII-V telegraf[30667]: 2025-01-26T21:24:05Z I! [agent] Config: Interval:2m0s, Quiet:false, Hostname:"pablo-MII-V", Flush Interva>
ene 26 18:24:05 pablo-MII-V telegraf[30667]: 2025-01-26T21:24:05Z W! [agent] The default value of 'skip_processors_after_aggregators' will change to '>
ene 26 18:24:05 pablo-MII-V systemd[1]: Started Telegraf.

[telegraf-tiger]

Hello! I recommend posting this question in our Community Slack or Community Forums, we have a lot of talented community members there who could help answer your question more quickly. You can also learn more about Telegraf by enrolling at InfluxDB University for free!

Heads up, this issue will be automatically closed after 7 days of inactivity. Thank you!