if string exists

[davidy718]

How can I have it so I search if a string exists in a log file
tired something like this

global:
  config_version: 3
input:
  type: file
  path: /var/logs/logfile.log
  readall: true
metrics:
- type: gauge
  name: error_in_log
  help: Error has been found in log.
  match: 'error'
  value: '{{if "error"}}1{{else}}0{{end}}'
  labels:
    logfile: '{{base .logfile}}'
server:
  port: 9144

if the string error is found in log file error_in_log will have the value of 1

[ashevchuk123]

Hi! Try something like this

      ...
      match: "%{ERROR_MESSAGE_PATTERN:error}."
      value: '{{ if eq .error "string to compare" }}1{{ else }}0{{ end }}'
      ...

[davidy718]

thanks for the reply @ashevchuk123
I get this
failed to initialize metric error_in_log: Pattern %{ERROR_MESSAGE_PATTERN:error} not defined.

[ashevchuk123]

Because you need to initialize patterns (variables with regexes) and include them in config.

    imports:
    - type: grok_patterns
      file: /path/to/patterns/file

in this file you may create patterns for your error, for example:
ERROR_MESSAGE_PATTERN (regex_for_your_error_here)

You may find examples for patterns in the zip archive provided in the release.

[davidy718]

OK thanks so much for the help : )

[davidy718]

my issue is that if the string is not found I don't get the metric error_in_log
is there a way to have it to 0 and if the string is found then its 1 value: '{{ if eq .error "string to compare" }}1{{ else }}0{{ end }}' this didn't work

[davidy718]

and im trying it with multiple metrics

global:
    config_version: 3
input:
    type: file
    paths:
    - /var/logs/logfile.log
    - /var/logs1/logfile.log
    readall: true
imports:
    - type: grok_patterns
      dir: /path/to/patterns/file
metrics:
    - type: gauge
      name: error_in_log
      help: Error has been found in log.
      match: "%{ERROR_MESSAGE_PATTERN:error}."
      value: '{{ if eq .error "string to compare" }}1{{ else }}0{{ end }}'
      path: /var/logs/logfile.log
      labels:
        logfile: '{{base .logfile}}'
    - type: gauge
      name: error_in_log_1
      help: Error has been found in log 1.
      match: "%{ERROR_MESSAGE_PATTERN:error}."
      value: '{{ if eq .error "string to compare" }}1{{ else }}0{{ end }}'
      path: /var/logs1/logfile.log
      labels:
        logfile: '{{base .logfile}}'
server:
    port: 9144

is this the right way to do it ?

[davidy718]

and I have in my patterns
ERROR_MESSAGE_PATTERN (.*)
but I always get 0