Skip to content

Commit 888d847

Browse files
committed
Add link to vjeantet/grok to grok parser docs
1 parent 1351663 commit 888d847

File tree

2 files changed

+9
-44
lines changed

2 files changed

+9
-44
lines changed

plugins/parsers/grok/README.md

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -59,11 +59,15 @@ To match a comma decimal point you can use a period. For example `%{TIMESTAMP:t
5959
To match a comma decimal point you can use a period in the pattern string.
6060
See https://golang.org/pkg/time/#Parse for more details.
6161

62-
Telegraf has many of its own [built-in patterns](/plugins/parsers/grok/influx_patterns.go),
63-
as well as support for most of
64-
[logstash's builtin patterns](https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/grok-patterns).
65-
_Golang regular expressions do not support lookahead or lookbehind.
66-
logstash patterns that depend on these are not supported._
62+
Telegraf has many of its own [built-in patterns][] as well as support for most
63+
of the Logstash builtin patterns using [these Go compatible patterns][grok-patterns].
64+
65+
**Note** Golang regular expressions do not support lookahead or lookbehind.
66+
Logstash patterns that use these features may not supported, or may use a Go
67+
friendly pattern that does is not always completely compatible with Logstash.
68+
69+
[built-in patterns]: /plugins/parsers/grok/influx_patterns.go
70+
[grok-patterns]: https://github.com/vjeantet/grok/blob/master/patterns/grok-patterns
6771

6872
If you need help building patterns to match your logs,
6973
you will find the https://grokdebug.herokuapp.com application quite useful!

plugins/parsers/grok/influx_patterns.go

Lines changed: 0 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -1,45 +1,6 @@
11
package grok
22

33
const DEFAULT_PATTERNS = `
4-
# Captures are a slightly modified version of logstash "grok" patterns, with
5-
# the format %{<capture syntax>[:<semantic name>][:<modifier>]}
6-
# By default all named captures are converted into string fields.
7-
# If a pattern does not have a semantic name it will not be captured.
8-
# Modifiers can be used to convert captures to other types or tags.
9-
# Timestamp modifiers can be used to convert captures to the timestamp of the
10-
# parsed metric.
11-
12-
# View logstash grok pattern docs here:
13-
# https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html
14-
# All default logstash patterns are supported, these can be viewed here:
15-
# https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/grok-patterns
16-
17-
# Available modifiers:
18-
# string (default if nothing is specified)
19-
# int
20-
# float
21-
# duration (ie, 5.23ms gets converted to int nanoseconds)
22-
# tag (converts the field into a tag)
23-
# drop (drops the field completely)
24-
# Timestamp modifiers:
25-
# ts-ansic ("Mon Jan _2 15:04:05 2006")
26-
# ts-unix ("Mon Jan _2 15:04:05 MST 2006")
27-
# ts-ruby ("Mon Jan 02 15:04:05 -0700 2006")
28-
# ts-rfc822 ("02 Jan 06 15:04 MST")
29-
# ts-rfc822z ("02 Jan 06 15:04 -0700")
30-
# ts-rfc850 ("Monday, 02-Jan-06 15:04:05 MST")
31-
# ts-rfc1123 ("Mon, 02 Jan 2006 15:04:05 MST")
32-
# ts-rfc1123z ("Mon, 02 Jan 2006 15:04:05 -0700")
33-
# ts-rfc3339 ("2006-01-02T15:04:05Z07:00")
34-
# ts-rfc3339nano ("2006-01-02T15:04:05.999999999Z07:00")
35-
# ts-httpd ("02/Jan/2006:15:04:05 -0700")
36-
# ts-epoch (seconds since unix epoch)
37-
# ts-epochnano (nanoseconds since unix epoch)
38-
# ts-"CUSTOM"
39-
# CUSTOM time layouts must be within quotes and be the representation of the
40-
# "reference time", which is Mon Jan 2 15:04:05 -0700 MST 2006
41-
# See https://golang.org/pkg/time/#Parse for more details.
42-
434
# Example log file pattern, example log looks like this:
445
# [04/Jun/2016:12:41:45 +0100] 1.25 200 192.168.1.1 5.432µs
456
# Breakdown of the DURATION pattern below:

0 commit comments

Comments
 (0)