Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Telegraf Logparser - Response code: tag or field? #1479

Closed
mpchadwick opened this issue Jul 11, 2016 · 6 comments · Fixed by #1511
Closed

Telegraf Logparser - Response code: tag or field? #1479

mpchadwick opened this issue Jul 11, 2016 · 6 comments · Fixed by #1511

Comments

@mpchadwick
Copy link

Proposal:

Response Code should be tag in the logparser plugin

Current behavior:

It is a field

Desired behavior:

Is should be a tag

Use case: [Why is this important (helps with prioritizing requests)]

There are a limited number of variants for response code so it shouldn't increase series cardinality too much. It is very likely that you would want to use response code in a WHERE or GROUP BY query. This was initially proposed in the Google group and got a thumbs up from @beckettsean

sparrc added a commit that referenced this issue Jul 18, 2016
@sparrc
Copy link
Contributor

sparrc commented Jul 18, 2016

👍

@Mikanoshi
Copy link

Mikanoshi commented Jul 26, 2016

And this totally disables queries like WHERE resp_code >= 400 :)
But when adding resp_code as int it disables GROUP BY... So had to add the code twice, which means adding it to log twice!
Casting values to integer in WHERE clause would be useful
influxdata/influxdb#5930

@sparrc
Copy link
Contributor

sparrc commented Jul 26, 2016

oh, shoot, now I remember that is why I made it a field in the first place. I'll have to think if I want to change it back now

@sparrc sparrc reopened this Jul 26, 2016
@sparrc sparrc changed the title Telegraf Logparser - Make Response Code A Tag Telegraf Logparser - Response code: tag or field? Jul 26, 2016
@jcmcken
Copy link
Contributor

jcmcken commented Jan 19, 2017

This change basically invalidates the discussion here, due to comparators not working with tags (as mentioned by @Mikanoshi)

@sparrc
Copy link
Contributor

sparrc commented Jan 21, 2017

if you want it as a field, you can change this by using your own custom log format:

COMMON_LOG_FORMAT_FIELD_RC %{CLIENT:client_ip} %{NOTSPACE:ident} %{NOTSPACE:auth} \[%{HTTPDATE:ts:ts-httpd}\] "(?:%{WORD:verb:tag} %{NOTSPACE:request}(?: HTTP/%{NUMBER:http_version:float})?|%{DATA})" %{NUMBER:resp_code:int} (?:%{NUMBER:resp_bytes:int}|-)

@danielnelson
Copy link
Contributor

Closing, use sparrc's technique to move the item to a tag if desired.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

5 participants