Skip to content

Instantly share code, notes, and snippets.

@SBajonczak
Created April 7, 2023 18:53
# Set global options
# Vector's API (disabled by default)
# Enable and try it out with the `vector top` command
[api]
enabled = true
address = "127.0.0.1:8686"
# Ingest data by tailing one or more files
[sources.sp_uls]
data_dir = "C:\\vector"
type = "file"
include = ["C:\\Logs\\WIN-4TP4OVUIPL6-*.log"] # supports globbing
ignore_older = 86400 # 1 day
[sources.metrics]
type = "host_metrics"
collectors = [
"cpu",
"disk",
"filesystem",
"load",
"host",
"memory",
"network"]
namespace = "host"
scrape_interval_secs = 1
[transforms.metricstolog]
type = "metric_to_log"
inputs = [ "metrics" ]
[sinks.loki]
type = "loki"
inputs = [ "transform"]
encoding.codec = "json"
endpoint = "http://x.x.x.x:3100"
[transforms.transform]
type = "remap"
inputs = [ "sp_uls"]
source = """
#. |= parse_regex!(.message, r'^(?P<TIMESTAMP>.{23})\t(?P<Process>.{40})\t(?P<ProcessID>.{6})\t(?P<Area>.{30})\t(?P<Category>.{30})\t(?P<logmessage>.{1,})')
. |= parse_regex!(.message, r'(?P<logmessage>.*)')
del(.message)
.data= split(.logmessage, "\t")
.Timestamp= .data[0]
.Process= .data[1]
.TID= .data[2]
.Area= .data[3]
.Category= .data[4]
.Level= .data[5]
.Severity= .data[6]
.Messagedata= .data[7]
.correlaion= .data[8]
del(.logmessage)
"""
[sinks.loki.labels]
pod_labels_name = "sharepoint"
pod_labels_app = "spweb"
source = "vector"
sharepoint_correlation= "{{ .correlation }}"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment