grok_exporter icon indicating copy to clipboard operation
grok_exporter copied to clipboard

Support for named pipes

Open mveroone opened this issue 3 years ago • 1 comments

What I attempted

syslog-ng writes logs it receives to several named pipes in the same folder depending on one of the fields of the lines (the http Host field in apache-like logs) Asking grok_exporter to read from all "files" in this folder ended up with this error message :

error reading log lines: /my/pipe: seek: seek /my/pipe: illegal seek

I guess that the file type is not fit to read from named piped.

I guess we could pipe them into individual grok_exporter processes directly from syslog-ng configuration, but that seems messy/hackish. We could also write log to a ramdisk with a very short rotation time, but that seems hackish too.

Context

We're attempting to calculate metrics using our CDN logs without storing them, which would save a bunch of I/O and storage space.

Considerations

  • grok_exporter already supports reading from stdin, this might not be too hard to implement, although I have zero experience with Go so I can't help.
  • For the record : mtail supports them but a bug in its code makes it unable to switch between several pipes of the rate of input is high enough so that it doesn't starve.

Anyway, thanks for the work so far, on regular files, the exporter works great ! 👍

mveroone avatar Dec 16 '20 15:12 mveroone