influxdata / influxdata/influxdb

Chronograf is not applying filter correctly for path tag when using inputs.tail on Windows

Open
#19,035 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Rust
Stars
31.7k
Forks
3.7k
Avg merge
13h 37m
Merged PRs (30d)
8

Description

I'm using the Telegraf plugin on Windows to send some messages to InfluxDB.
The messages are getting there but when I use Chronograf to drill through to the value, the filters are not working properly.

Here's a snippet from telegraf.conf :
```
[[inputs.tail]]
files = ["Z:\\telegraf\\test.log"]
from_beginning = false
grok_patterns = ["^.*Error%{GREEDYDATA:msg:string}"]
name_override = "logs"
grok_custom_pattern_files = []
grok_custom_patterns = ''''''
data_format = "grok"
```
So any log message in test.log that has the word "Error" will generate a single field called "msg" with the contents after that.

In Chronograf, I can see the series is created, and if I select *only* the msg value (last column in Chronograf explorer), I can see the values in a table.
However, if I also select the "path" tag (which above has double back-slashes but in Chronograf is represented correctly with single back-slash) then no results are returned.

If I then amend the query directly and change the path name to have double back-slashes, it works.

So looks like when using the explorer view and drilling through metrics, Chronograf should convert a single backslash to double backslash before adding to the query.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue with the provided inputs.tail configuration on Windows, then inspect the Chronograf explorer drill-through behavior for the path tag. Compare the generated query when the path contains single versus double backslashes; done means selecting the path tag returns the same results as the manually corrected query.

Written by the indexing model from the issue text.

Assessment

Domain
databases, observability
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.