In the example above, the log message has a timestamp. INFO 1476925272 my operation took 42 seconds (and other info here) Each macro can consist of sub-macros, and each macro can bind a substring to a label. You can think of a grok pattern as a regexe with macros. See Dropwizard documentation for details.

There are three supported modes of aggregation: counters, gauges, and histograms. Through valueLabel, you can specify which part of the log line contains the metrics to send.

Log lines are given structure with java-grok, which is the syntax for the Logstash grok plugin. This configuration file is parsed as a POJO see the javadoc for more details on each field. In your Wavefront proxy configuration file, add these new entries:ĪggregationIntervalSeconds : 5 # Metrics are aggregated and sent at this interval counters : - pattern : ' % seconds' metricName : ' myOperationDuration' valueLabel : ' duration' Configuring the Wavefront Proxy to Listen for Log Data The example is merely a starting point- so you understand how to ingest metrics from any log format. In this example, we configure VMware Aria Operations for Applications to parse Combined Apache Logs, which is a common logging format for many web services (for example, NGiNX).

Click the Setup tab and follow the instructions.Ĭonfiguring the Wavefront Proxy to Ingest Log Data.

Click Integrations and click the Log Data tile.

The built-in Log Data integration guides you through installing a Wavefront proxy. Installing and Configuring a Wavefront Proxy The Create Metrics from Logs for Real-Time Cloud Application Monitoring blog post discusses a real example and complements this page.

Information about the actual source (host) is lost.

The counters collide when they are sent to VMware Aria Operations for Applications.

When traffic is split between nodes, each node tracks its own counter.

Warning Log ingestion functionality does not work well if you use a load balancer in your environment.

Wavefront proxy 4.4 and later supports these methods. VMware Aria Operations for Applications supports two methods for sending log data metrics to a Wavefront proxy: Filebeat and TCP.

Tcp log view