How to tie a metric to a log filename

[Matt Bostock]

Hello,

I have some logs which are centralised and one server. The log filenames are in the format:

hostname.log

...where each file has logs for the named machine.

I realise this is a bit of an anti-pattern for mtail, however in this specific use case there's no way that I can collect these logs on the server (or closer to the source) as they're pulled from a blackbox system.

I'd like to be able to tie a a counter metric to the log filenames. In other words, if mtail matches a string in the logfile for host foo, the metric might look like:

metric{prog="bar", host="foo"}

Is this possible currently?

Thanks,

Matt

[Jamie Wilkinson]

No, it's not possible currently.  To do so the mtail program needs to know the input log filename at the time of the parse, which is currently not passed to the program.  The language implicitly assumes a match is applied to the log line itself, not the log filename or any other metadata.

I'm open to adding this feature if we can figure out how to change the language. I am wary of using a magic variable name, for example, because it seems ugly; but I've already done that for storing the log line timestamp.

An alternative (if you want to try to do this today) is to apply that host label by the component peforming the scrape; in Prometheus, for example, you can annotate in the targets list a set of labels you want to apply to those targets.  See https://prometheus.io/docs/operating/configuration/#<relabel_config>

But you said you pull them from the server already, so you'd have to do this multiplexing locally: I can think of some other workarounds which are probably unpalateable: run an mtail per remote host, and then you can apply the host label individually per host:port combination.  Yeah, I don't like that either.  It would be easier in *this* case if mtail had a commandline flag of a label that was applied globally to the export, then you wouldn't have to keep a mapping of mtail host:port addresses to log lines, because your mtail commandline would already know the log file it is tracking and can pass it in twice (i.e once to the logs flag, and once to this hypothetical global label flag.)

--
You received this message because you are subscribed to the Google Groups "mtail-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to mtail-users...@googlegroups.com.
To post to this group, send email to mtail...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/mtail-users/98b2365b-a670-4c84-aca3-d20638117bc6%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Jamie Wilkinson]

https://github.com/google/mtail/issues/36 filed.