Removing INFLUXDB_HTTP_LOG from logparser usage/docs

this log format is likely soon going to be removed from a future
influxdb release, so we should not be recommending that users base any
of their log parsing infra on this.

etc/telegraf.conf

@@ -1577,7 +1577,7 @@
 #   ##   /var/log/**.log     -> recursively find all .log files in /var/log
 #   ##   /var/log/*/*.log    -> find all .log files with a parent dir in /var/log
 #   ##   /var/log/apache.log -> only tail the apache log file
-#   files = ["/var/log/influxdb/influxdb.log"]
+#   files = ["/var/log/apache/access.log"]
 #   ## Read file from beginning.
 #   from_beginning = false
 #
@@ -1590,9 +1590,9 @@
 #     ## Other common built-in patterns are:
 #     ##   %{COMMON_LOG_FORMAT}   (plain apache & nginx access logs)
 #     ##   %{COMBINED_LOG_FORMAT} (access logs + referrer & agent)
-#     patterns = ["%{INFLUXDB_HTTPD_LOG}"]
+#     patterns = ["%{COMBINED_LOG_FORMAT}"]
 #     ## Name of the outputted measurement name.
-#     measurement = "influxdb_log"
+#     measurement = "apache_access_log"
 #     ## Full path(s) to custom pattern files.
 #     custom_pattern_files = []
 #     ## Custom patterns can also be defined here. Put one pattern per line.

plugins/inputs/logparser/README.md

@@ -14,17 +14,22 @@ regex patterns.
   ##   /var/log/**.log     -> recursively find all .log files in /var/log
   ##   /var/log/*/*.log    -> find all .log files with a parent dir in /var/log
   ##   /var/log/apache.log -> only tail the apache log file
-  files = ["/var/log/influxdb/influxdb.log"]
+  files = ["/var/log/apache/access.log"]
   ## Read file from beginning.
   from_beginning = false
 
   ## Parse logstash-style "grok" patterns:
-  ##   Telegraf builtin parsing patterns: https://goo.gl/dkay10
+  ##   Telegraf built-in parsing patterns: https://goo.gl/dkay10
   [inputs.logparser.grok]
     ## This is a list of patterns to check the given log file(s) for.
     ## Note that adding patterns here increases processing time. The most
-    ## efficient configuration is to have one file & pattern per logparser.
+    ## efficient configuration is to have one pattern per logparser.
-    patterns = ["%{INFLUXDB_HTTPD_LOG}"]
+    ## Other common built-in patterns are:
+    ##   %{COMMON_LOG_FORMAT}   (plain apache & nginx access logs)
+    ##   %{COMBINED_LOG_FORMAT} (access logs + referrer & agent)
+    patterns = ["%{COMBINED_LOG_FORMAT}"]
+    ## Name of the outputted measurement name.
+    measurement = "apache_access_log"
     ## Full path(s) to custom pattern files.
     custom_pattern_files = []
     ## Custom patterns can also be defined here. Put one pattern per line.
@@ -32,8 +37,6 @@ regex patterns.
     '''
 ```
 
-> **Note:** The InfluxDB log pattern in the default configuration only works for Influx versions 1.0.0-beta1 or higher.
-
 ## Grok Parser
 
 The grok parser uses a slightly modified version of logstash "grok" patterns,

plugins/inputs/logparser/grok/grok_test.go

@@ -38,32 +38,6 @@ func Benchmark_ParseLine_CombinedLogFormat(b *testing.B) {
 	benchM = m
 }
 
-func Benchmark_ParseLine_InfluxLog(b *testing.B) {
-	p := &Parser{
-		Patterns: []string{"%{INFLUXDB_HTTPD_LOG}"},
-	}
-	p.Compile()
-
-	var m telegraf.Metric
-	for n := 0; n < b.N; n++ {
-		m, _ = p.ParseLine(`[httpd] 192.168.1.1 - - [14/Jun/2016:11:33:29 +0100] "POST /write?consistency=any&db=telegraf&precision=ns&rp= HTTP/1.1" 204 0 "-" "InfluxDBClient" 6f61bc44-321b-11e6-8050-000000000000 2513`)
-	}
-	benchM = m
-}
-
-func Benchmark_ParseLine_InfluxLog_NoMatch(b *testing.B) {
-	p := &Parser{
-		Patterns: []string{"%{INFLUXDB_HTTPD_LOG}"},
-	}
-	p.Compile()
-
-	var m telegraf.Metric
-	for n := 0; n < b.N; n++ {
-		m, _ = p.ParseLine(`[retention] 2016/06/14 14:38:24 retention policy shard deletion check commencing`)
-	}
-	benchM = m
-}
-
 func Benchmark_ParseLine_CustomPattern(b *testing.B) {
 	p := &Parser{
 		Patterns: []string{"%{TEST_LOG_A}", "%{TEST_LOG_B}"},
@@ -108,9 +82,9 @@ func TestMeasurementName(t *testing.T) {
 	assert.Equal(t, "my_web_log", m.Name())
 }
 
-func TestBuiltinInfluxdbHttpd(t *testing.T) {
+func TestCustomInfluxdbHttpd(t *testing.T) {
 	p := &Parser{
-		Patterns: []string{"%{INFLUXDB_HTTPD_LOG}"},
+		Patterns: []string{`\[httpd\] %{COMBINED_LOG_FORMAT} %{UUID:uuid:drop} %{NUMBER:response_time_us:int}`},
 	}
 	assert.NoError(t, p.Compile())
 

plugins/inputs/logparser/grok/influx_patterns.go

@@ -55,15 +55,13 @@ EXAMPLE_LOG \[%{HTTPDATE:ts:ts-httpd}\] %{NUMBER:myfloat:float} %{RESPONSE_CODE}
 # Wider-ranging username matching vs. logstash built-in %{USER}
 NGUSERNAME [a-zA-Z\.\@\-\+_%]+
 NGUSER %{NGUSERNAME}
+# Wider-ranging client IP matching
+CLIENT (?:%{IPORHOST}|%{HOSTPORT}|::1)
 
 ##
 ## COMMON LOG PATTERNS
 ##
 
-# InfluxDB log patterns
-CLIENT (?:%{IPORHOST}|%{HOSTPORT}|::1)
-INFLUXDB_HTTPD_LOG \[httpd\] %{COMBINED_LOG_FORMAT} %{UUID:uuid:drop} %{NUMBER:response_time_us:int}
-
 # apache & nginx logs, this is also known as the "common log format"
 #   see https://en.wikipedia.org/wiki/Common_Log_Format
 COMMON_LOG_FORMAT %{CLIENT:client_ip} %{NGUSER:ident} %{NGUSER:auth} \[%{HTTPDATE:ts:ts-httpd}\] "(?:%{WORD:verb:tag} %{NOTSPACE:request}(?: HTTP/%{NUMBER:http_version:float})?|%{DATA})" %{NUMBER:resp_code:tag} (?:%{NUMBER:resp_bytes:int}|-)

plugins/inputs/logparser/grok/patterns/influx-patterns

@@ -51,15 +51,13 @@ EXAMPLE_LOG \[%{HTTPDATE:ts:ts-httpd}\] %{NUMBER:myfloat:float} %{RESPONSE_CODE}
 # Wider-ranging username matching vs. logstash built-in %{USER}
 NGUSERNAME [a-zA-Z\.\@\-\+_%]+
 NGUSER %{NGUSERNAME}
+# Wider-ranging client IP matching
+CLIENT (?:%{IPORHOST}|%{HOSTPORT}|::1)
 
 ##
 ## COMMON LOG PATTERNS
 ##
 
-# InfluxDB log patterns
-CLIENT (?:%{IPORHOST}|%{HOSTPORT}|::1)
-INFLUXDB_HTTPD_LOG \[httpd\] %{COMBINED_LOG_FORMAT} %{UUID:uuid:drop} %{NUMBER:response_time_us:int}
-
 # apache & nginx logs, this is also known as the "common log format"
 #   see https://en.wikipedia.org/wiki/Common_Log_Format
 COMMON_LOG_FORMAT %{CLIENT:client_ip} %{NGUSER:ident} %{NGUSER:auth} \[%{HTTPDATE:ts:ts-httpd}\] "(?:%{WORD:verb:tag} %{NOTSPACE:request}(?: HTTP/%{NUMBER:http_version:float})?|%{DATA})" %{NUMBER:resp_code:tag} (?:%{NUMBER:resp_bytes:int}|-)

plugins/inputs/logparser/logparser.go

@@ -45,7 +45,7 @@ const sampleConfig = `
   ##   /var/log/**.log     -> recursively find all .log files in /var/log
   ##   /var/log/*/*.log    -> find all .log files with a parent dir in /var/log
   ##   /var/log/apache.log -> only tail the apache log file
-  files = ["/var/log/influxdb/influxdb.log"]
+  files = ["/var/log/apache/access.log"]
   ## Read file from beginning.
   from_beginning = false
 
@@ -58,9 +58,9 @@ const sampleConfig = `
     ## Other common built-in patterns are:
     ##   %{COMMON_LOG_FORMAT}   (plain apache & nginx access logs)
     ##   %{COMBINED_LOG_FORMAT} (access logs + referrer & agent)
-    patterns = ["%{INFLUXDB_HTTPD_LOG}"]
+    patterns = ["%{COMBINED_LOG_FORMAT}"]
     ## Name of the outputted measurement name.
-    measurement = "influxdb_log"
+    measurement = "apache_access_log"
     ## Full path(s) to custom pattern files.
     custom_pattern_files = []
     ## Custom patterns can also be defined here. Put one pattern per line.