Get data from syslog about prometheus-nginxlog-exporter

[martin-helmich]

Sure. Simply change your format in the exporter's config file to match the syslog format (which is essentially the NGINX format with a few prepended fields):

format = "$month $day $time $host $service: $remote_addr [$time_local] \"$request\" $status $body_bytes_sent \"$http_referer\" \"$http_user_agent\" $request_time $upstream_response_time"

Hope this helps.

[AntonVozdvizhenskiy]

Thanks! it work

[AntonVozdvizhenskiy]

Unfortunately, in begining of month it not work
In syslog date format present leading space, it break regexp parse logic

Feb  2 16:00:02 somehost nginx: 8.8.8.8 [23/Jan/2018:16:00:02 +0300] "GET /bla?id=1 HTTP/1.1" 200 100 "http://bla.com/" "Mozilla/5.0 ..." 0.031 0.031
Feb  2 16:00:03 somehost nginx: 8.8.8.8 [23/Jan/2018:16:00:03 +0300] "GET /bla?id=2 HTTP/1.1" 200 100 "http://bla.com/" "Mozilla/5.0 ..." 0.032 0.032
   ^^

format = "$month $day $time $hostname $service: $remote_addr $host [$time_local] \"$request\" $status $body_bytes_sent $request_time $upstream_response_time"

^(?P<month>[^ ]*) (?P<day>[^ ]*) (?P<time>[^ ]*) (?P<hostname>[^ ]*) (?P<service>[^:]*): (?P<remote_addr>[^ ]*) (?P<host>[^ ]*) \[(?P<time_local>[^]]*)\] "(?P<request>[^"]*)" (?P<status>[^ ]*) (?P<body_bytes_sent>[^ ]*) (?P<request_time>[^ ]*) (?P<upstream_response_time>[^ ]*)$