"cumulative: false" is not working

[berniestm]

trafficstars

Hi, I use Grok to count the number of late transit from a CSV file which is created every 2min +/-10sec.

I want a real-time view of the number of late transit for each new CSV File but the number is not cumulative between 2 files. My config GROK :

• retention_check_interval: 1s
• type: counter
• cumulative: false ( * retention => not use )

"cumulative: false" is not working. Each new CSF File, the number of my counter is doubled.

[fstab]

cumulative is for gauge metrics, not for counter metrics. I'm not sure if I understand correctly what you want to do, but usually if you have two counters from to different files you would sum them in Prometheus with a PromQL query. So you keep the counters separate in grok_exporter, and your Prometheus query calculates the sum.

[berniestm]

Hi,

Thank you for your reply.

My counters metrics are from the same log file. My case is similar as the counter exemple on github :

HELP grok_example_lines_total Example counter metric with labels.

TYPE grok_example_lines_total counter

grok_example_lines_total{user="alice"} 3 grok_example_lines_total{user="bob"} 1

Each time I have a new log file, the counter value is cumulate. I use « retention » to reset the counter but my new log file is create every 2min +/- 15sec.

It will by a nice to have the same option « cumulative:false » for the counter metric in the futur version.

De : Fabian Stäber @.> Envoyé : 16 mai 2021 16:32 À : fstab/grok_exporter @.> Cc : Fongue, Bertrand @.>; Author @.> Objet : [EXTERNE] Re: [fstab/grok_exporter] "cumulative: false" is not working (#152)

ATTENTION: Ce message NE provient PAS de votre organisation, merci de faire attention aux liens et aux pieces jointes.

cumulative is for gauge metrics, not for counter metrics. I'm not sure if I understand correctly what you want to do, but usually if you have two counters from to different files you would sum them in Prometheus with a PromQL query. So you keep the counters separate in grok_exporter, and your Prometheus query calculates the sum.

[berniestm]

Adding information issue

---

My config for :

• Counter Metric

- type: counter 
  name: grok_example_lines_total_CounterMetrique_NoCumulative
  help: Example counter metric with labels.
  match: '%{DATE} %{TIME} %{USER:user} %{NUMBER:val}'
  value: '{{.val}}'
  labels:
      user: '{{.user}}'

• Gauge metric : cumultaive false

- type: gauge
  name: grok_example_values_GaugeMetrique_CumulativeFalse
  help: Example gauge metric with labels.
  match: '%{DATE} %{TIME} %{USER:user} %{NUMBER:val}'
  value: '{{.val}}'
  cumulative: false
  labels:
      user: '{{.user}}'

• Gauge metric : cumulative true

- type: gauge
  name: grok_example_values_GaugeMetrique_CumulativeTrue
  help: Example gauge metric with labels.
  match: '%{DATE} %{TIME} %{USER:user} %{NUMBER:val}'
  value: '{{.val}}'
  cumulative: true
  labels:
      user: '{{.user}}'

---

First file

source file

30.07.2016 14:37:03 alice 1.5
30.07.2016 14:37:33 alice 2.5
30.07.2016 14:43:02 bob 2.5
30.07.2016 14:45:59 alice 2.5

Grok : (http://localhost:9141/metrics)

# HELP grok_example_lines_total_CounterMetrique_NoCumulative Example counter metric with labels.
# TYPE grok_example_lines_total_CounterMetrique_NoCumulative counter
grok_example_lines_total_CounterMetrique_NoCumulative{user="alice"} 6.5
grok_example_lines_total_CounterMetrique_NoCumulative{user="bob"} 2.5
# HELP grok_example_values_GaugeMetrique_CumulativeFalse Example gauge metric with labels.
# TYPE grok_example_values_GaugeMetrique_CumulativeFalse gauge
grok_example_values_GaugeMetrique_CumulativeFalse{user="alice"} 2.5
grok_example_values_GaugeMetrique_CumulativeFalse{user="bob"} 2.5
# HELP grok_example_values_GaugeMetrique_CumulativeTrue Example gauge metric with labels.
# TYPE grok_example_values_GaugeMetrique_CumulativeTrue gauge
grok_example_values_GaugeMetrique_CumulativeTrue{user="alice"} 6.5
grok_example_values_GaugeMetrique_CumulativeTrue{user="bob"} 2.5

---

Second file

source file

30.07.2016 14:37:33 alice 2.5
30.07.2016 14:43:02 bob 2.5
30.07.2016 14:45:59 alice 2.5
30.07.2016 14:37:03 alice 1.5

Grok: (http://localhost:9141/metrics)

# HELP grok_example_lines_total_CounterMetrique_NoCumulative Example counter metric with labels.
# TYPE grok_example_lines_total_CounterMetrique_NoCumulative counter
grok_example_lines_total_CounterMetrique_NoCumulative{user="alice"} 13
grok_example_lines_total_CounterMetrique_NoCumulative{user="bob"} 5
# HELP grok_example_values_GaugeMetrique_CumulativeFalse Example gauge metric with labels.
# TYPE grok_example_values_GaugeMetrique_CumulativeFalse gauge
grok_example_values_GaugeMetrique_CumulativeFalse{user="alice"} 1.5
grok_example_values_GaugeMetrique_CumulativeFalse{user="bob"} 2.5
# HELP grok_example_values_GaugeMetrique_CumulativeTrue Example gauge metric with labels.
# TYPE grok_example_values_GaugeMetrique_CumulativeTrue gauge
grok_example_values_GaugeMetrique_CumulativeTrue{user="alice"} 13
grok_example_values_GaugeMetrique_CumulativeTrue{user="bob"} 5

---

Question

At the second file, I would like to get for "the Gauge metric : cumulative true" : Grok: (http://localhost:9141/metrics)

# HELP grok_example_values_GaugeMetrique_CumulativeTrue Example gauge metric with labels.
# TYPE grok_example_values_GaugeMetrique_CumulativeTrue gauge
grok_example_values_GaugeMetrique_CumulativeTrue{user="alice"} 6.5
grok_example_values_GaugeMetrique_CumulativeTrue{user="bob"} 2.5

What do I missdo for "the Gauge metric : cumulative true" ?