telegraf GROK pattern matching issues
-
I have pfBlocker enabled with GEOIP blocking, and I've been able to get the DNSBL logs to parse and go into InfluxDB. The issue I'm h[0_1564446396094_sanatizedlogsample.csv](Uploading 0%) aving is I can't seem to get this to work for the ip_block.log and was hoping some GROK guru would be willing to give some advice.
I've used https://grokdebug.herokuapp.com/ and it says I have a valid GROK pattern, so not sure what I'm missing.
My telegraf.conf entry is as follows, with sample data (sanatizedlogsample.zip) attached.
[[inputs.logparser]] files = ["/var/log/pfblockerng/ip_block.log"] from_beginning=true [inputs.logparser.grok] measurement = "ipblock_log" patterns = ["^%{SYSLOGTIMESTAMP:timestamp},%{GREEDYDATA:tracker_id},%{WORD:interface},%{WORD:interface_name},%{WORD:action},%{WORD:ipversion},%{WORD:protocol_id},%{WORD:protocol},%{GREEDYDATA:src_ip},%{GREEDYDATA:dst_ip},%{GREEDYDATA:src_port>},%{GREEDYDATA:dst_port},%{WORD:dst_port_dir},%{WORD:country_code},%{WORD:alias_name},%{GREEDYDATA:ip_evaluated},%{WORD:feed_name},%{GREEDYDATA:resolved_hostname},%{WORD:client_hostname},%{WORD:asn},%{GREEDYDATA:hitormiss}"] timezone = "Local" [inputs.logparser.tags] value = "2"
The target is InfluxDB,not sure if that makes a difference or not.
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.