topic Re: How do I pull a log file directly in as a metric? in Getting Data In

How do I pull a log file directly in as a metric?

daniel333 — Tue, 29 Sep 2020 21:29:19 GMT

All,

I am playing with metricbeat and I am happy camper with it. I was wondering if there was a way to pull the metricbeat logs in directly as a metric rather than as a log?

Example logs
2017-12-17T18:54:16.241-0500 INFO logp/core_test.go:13 unnamed global logger
2017-12-17T18:54:16.242-0500 INFO [example] logp/core_test.go:16 some message
2017-12-17T18:54:16.242-0500 INFO [example] logp/core_test.go:19 some message {"x": 1}

Re: How do I pull a log file directly in as a metric?

back2root — Thu, 04 Oct 2018 02:12:46 GMT

Maybe you wanna have a look at Splunk 7.2.0 newest feature "log-to-metrics conversion":
http://docs.splunk.com/Documentation/Splunk/7.2.0/Metrics/L2MOverview

Pre 7.2.0 you need to write props/transforms: http://docs.splunk.com/Documentation/Splunk/7.1.3/Metrics/GetMetricsInOther

Re: How do I pull a log file directly in as a metric?

iamarkaprabha — Thu, 04 Oct 2018 06:07:02 GMT

You can try using uberagent app.
https://splunkbase.splunk.com/app/1448/