3c7cea1a55
I switched from tail.csv to tail.grok because of a timestamp issue https://github.com/influxdata/telegraf/issues/8948 I also went on a journey of digging through the grok pattern and error logs to eliminate as many parse errors as possible.
28 lines
1.4 KiB
Plaintext
28 lines
1.4 KiB
Plaintext
[[inputs.exec]]
|
|
commands = [
|
|
"/usr/local/bin/telegraf_pfinterface.php",
|
|
"/usr/local/bin/telegraf_gateways.py",
|
|
"sh /usr/local/bin/telegraf_temperature.sh"
|
|
]
|
|
data_format = "influx"
|
|
|
|
[[inputs.tail]]
|
|
files = ["/var/log/pfblockerng/dnsbl.log"]
|
|
data_format = "grok"
|
|
from_beginning = false
|
|
name_suffix = "_dnsbl_log"
|
|
grok_timezone = "Local"
|
|
grok_patterns = ["^%{WORD:blocktype}-%{WORD:blocksubtype},%{SYSLOGTIMESTAMP:timestamp:ts-syslog},%{IPORHOST:domain},%{IPORHOST:src_ip:tag},%{GREEDYDATA:req_agent},%{WORD:blockmethod},%{WORD:blocklist},%{IPORHOST:tld:tag},%{WORD:feed_name:tag},%{GREEDYDATA:duplicateeventstatus}"]
|
|
|
|
[[inputs.tail]]
|
|
files = ["/var/log/pfblockerng/ip_block.log"]
|
|
data_format = "grok"
|
|
from_beginning = false
|
|
name_suffix = "_ip_block_log"
|
|
grok_timezone = "Local"
|
|
grok_patterns = ["^%{SYSLOGTIMESTAMP:timestamp:ts-syslog},%{NUMBER:rulenum},%{DATA:interface},%{WORD:friendlyname},%{WORD:action},%{NUMBER:ip_version},%{NUMBER:protocolid},%{DATA:protocol},%{IPORHOST:src_ip:tag},%{IPORHOST:dest_ip:tag},%{WORD:src_port},%{NUMBER:dest_port},%{WORD:direction},%{WORD:geoip_code:tag},%{DATA:ip_alias_name},%{DATA:ip_evaluated},%{DATA:feed_name:tag},%{HOSTNAME:resolvedhostname},%{GREEDYDATA:clienthostname},%{GREEDYDATA:ASN},%{GREEDYDATA:duplicateeventstatus}"]
|
|
|
|
#[[inputs.unbound]]
|
|
# server = "127.0.0.1:953"
|
|
# binary = "/usr/local/bin/telegraf_unbound.sh"
|