Logparser 🔗

The Splunk Distribution of OpenTelemetry Collector uses the Smart Agent receiver with the telegraf/logparser monitor type to tail log files.

This integration is based on the Telegraf logparser plugin, and all emitted metrics have the plugin dimension set to telegraf-logparser.

Benefits 🔗

After you configure the integration, you can access these features:

View metrics. You can create your own custom dashboards, and most monitors provide built-in dashboards as well. For information about dashboards, see View dashboards in Observability Cloud.
View a data-driven visualization of the physical servers, virtual machines, AWS instances, and other resources in your environment that are visible to Infrastructure Monitoring. For information about navigators, see Splunk Infrastructure Monitoring navigators.
Access the Metric Finder and search for metrics sent by the monitor. For information, see Use the Metric Finder.

Installation 🔗

Follow these steps to deploy this integration:

Deploy the Splunk Distribution of OpenTelemetry Collector to your host or container platform:
Configure the monitor, as described in the Configuration section.
Restart the Splunk Distribution of OpenTelemetry Collector.

Configuration 🔗

To use this integration of a Smart Agent monitor with the Collector:

Include the Smart Agent receiver in your configuration file.
Add the monitor type to the Collector configuration, both in the receiver and pipelines sections.

Read more on how to Use Smart Agent monitors with the Collector.
See how to set up the Smart Agent receiver.
Learn about config options in Collector default configuration.

Example 🔗

To activate this integration, add the following to your Collector configuration:

receivers:
  smartagent/logparser:
    type: telegraf/logparser
    ...  # Additional config

To complete the integration, include this monitor type as a member of a logs pipeline. Use the SignalFx exporter to make event submission requests. Use the Resource Detection processor to ensure that host identity and other useful information is made available as event dimensions. For example:

service:
  pipelines:
    logs:
      receivers:
        - smartagent/logparser
      processors:
        - resourcedetection
      exporters:
        - signalfx

The following example shows a sample YAML configuration:

receivers:
  smartagent/logparser:
    type: telegraf/logparser
    files:
     - '$file'
    watchMethod: poll
    # Specifies the file watch method ("inotify" or "poll").
    fromBeginning: true     
    # Specifies to read from the beginning.
    measurementName: test-measurement 
    # This is the metric name prefix.
    patterns:
     - "%{COMMON_LOG_FORMAT}" 
    # Specifies the Apache Common Log Format (CLF).
    timezone: UTC

Configuration options 🔗

The following table shows the configuration options for this monitor type:

Option	Required	Type	Description
`files`	yes	`list of strings`	Paths to files to be tailed
`watchMethod`	no	`string`	Method for watching changes to files (“ionotify” or “poll”). The default value is `poll`.
`fromBeginning`	no	`bool`	Whether to start tailing from the beginning of the file. The default value is `false`.
`measurementName`	no	`string`	Name of the measurement
`patterns`	no	`list of strings`	A list of patterns to match.
`namedPatterns`	no	`list of strings`	A list of named grok patterns to match.
`customPatterns`	no	`string`	Custom grok patterns. (`grok` only)
`customPatternFiles`	no	`list of strings`	List of paths to custom grok pattern files.
`timezone`	no	`string`	Specifies the timezone. The default is UTC time. Other options are `Local` for the local time on the machine, `UTC`, and `Canada/Eastern` (unix style timezones).

Metrics 🔗

The Splunk Distribution of OpenTelemetry Collector does not do any built-in filtering of metrics coming out of this monitor type.

Troubleshooting 🔗

If you are not able to see your data in Splunk Observability Cloud, try these tips:

Submit a case in the Splunk Support Portal
- Available to Splunk Observability Cloud customers
Call Splunk Customer Support
- Available to Splunk Observability Cloud customers
Ask a question and get answers through community support at Splunk Answers
- Available to Splunk Observability Cloud customers and free trial users
Join the Splunk #observability user group Slack channel to communicate with customers, partners, and Splunk employees worldwide
- Available to Splunk Observability Cloud customers and free trial users
- To learn how to join, see Get Started with Splunk Community - Chat groups

To learn about even more support options, see Splunk Customer Success.

Related Topics