search

fstab / grok_exporter

Export Prometheus metrics from arbitrary unstructured log data.
Apache License 2.0
891 stars 152 forks source link

Grok exporter returns single output for multiple same log lines #146

Open cazzprogrammer opened 3 years ago

cazzprogrammer commented 3 years ago

Hi Fstab,

My Log file has many log lines which is exactly same and i want them to all the log lines as output of the grok exporter( i.e in /metrics page). But it seems the grok Exporter returns only one line for those multiple log lines.

Example;

Log lines...................................................................................................................

172.xx.xx.xx - - [22/feb/2021:01:09:50 -0800 - "POST /fstab/grok_exporter/issue HTTP/1.1" 200 681 323232 172.xx.xx.xx - - [22/feb/2021:01:09:50 -0800 - "POST /fstab/grok_exporter/issue HTTP/1.1" 200 681 323232

The output i want in grok page......................................

log_monitoring{code="200",date="22/feb/2021:01:09:50 -0800",load="681",method="POST",path="/fstab/grok_exporter/issue"} 323232
log_monitoring{code="200",date="22/feb/2021:01:09:50 -0800",load="681",method="POST",path="/fstab/grok_exporter/issue"} 323232

But the orginal output is: log_monitoring{code="200",date="22/feb/2021:01:09:50 -0800",load="681",method="POST",path="/fstab/grok_exporter/issue"} 323232

Is there a way to get both the log line in the ouput.

thanks

fstab commented 3 years ago

It looks like you are using a gauge metric with 323232 as a value. You could use a counter metric and 323232 as a label. For example, if you call the label n you would get:

log_monitoring{code="200",date="22/feb/2021:01:09:50 -0800",load="681",method="POST",path="/fstab/grok_exporter/issue" n="323232"} 2

The metric counts the number of occurrences, and 2 means that this exact combination of label values was observed twice.