From 677e4d66856e9aeb7afa3e686f3bc028276c3f83 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adri=C3=A1n=20L=C3=B3pez?= <adrianlzt+github@gmail.com>
Date: Wed, 15 Aug 2018 04:53:25 +0800
Subject: [PATCH] Document how to parse telegraf logs (#4285)

---
 plugins/inputs/logparser/README.md | 42 ++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/plugins/inputs/logparser/README.md b/plugins/inputs/logparser/README.md
index d35a94a709e6f..27cbc3cf44062 100644
--- a/plugins/inputs/logparser/README.md
+++ b/plugins/inputs/logparser/README.md
@@ -220,6 +220,48 @@ A multi-line literal string allows us to encode the pattern:
     custom_patterns = 'UNICODE_ESCAPE (?:\\u[0-9A-F]{4})+'
 ```
 
+#### Parsing Telegraf log file
+We can use logparser to convert the log lines generated by Telegraf in metrics.
+
+To do this we need to configure Telegraf to write logs to a file.
+This could be done using the ``agent.logfile`` parameter or configuring syslog.
+```toml
+[agent]
+  logfile = "/var/log/telegraf/telegraf.log"
+```
+
+Logparser configuration:
+```toml
+[[inputs.logparser]]
+  files = ["/var/log/telegraf/telegraf.log"]
+
+  [inputs.logparser.grok]
+    measurement = "telegraf_log"
+    patterns = ['^%{TIMESTAMP_ISO8601:timestamp:ts-rfc3339} %{TELEGRAF_LOG_LEVEL:level:tag}! %{GREEDYDATA:msg}']
+    custom_patterns = '''
+TELEGRAF_LOG_LEVEL (?:[DIWE]+)
+'''
+```
+
+Example log lines:
+```
+2018-06-14T06:41:35Z I! Starting Telegraf v1.6.4
+2018-06-14T06:41:35Z I! Agent Config: Interval:3s, Quiet:false, Hostname:"archer", Flush Interval:3s
+2018-02-20T22:39:20Z E! Error in plugin [inputs.docker]: took longer to collect than collection interval (10s)
+2018-06-01T10:34:05Z W! Skipping a scheduled flush because there is already a flush ongoing.
+2018-06-14T07:33:33Z D! Output [file] buffer fullness: 0 / 10000 metrics.
+```
+
+Generated metrics:
+```
+telegraf_log,host=somehostname,level=I msg="Starting Telegraf v1.6.4" 1528958495000000000
+telegraf_log,host=somehostname,level=I msg="Agent Config: Interval:3s, Quiet:false, Hostname:\"somehostname\", Flush Interval:3s" 1528958495001000000
+telegraf_log,host=somehostname,level=E msg="Error in plugin [inputs.docker]: took longer to collect than collection interval (10s)" 1519166360000000000
+telegraf_log,host=somehostname,level=W msg="Skipping a scheduled flush because there is already a flush ongoing." 1527849245000000000
+telegraf_log,host=somehostname,level=D msg="Output [file] buffer fullness: 0 / 10000 metrics." 1528961613000000000
+```
+
+
 ### Tips for creating patterns
 
 Writing complex patterns can be difficult, here is some advice for writing a