即使当前没有错误，Grok导出器计数也不会减少

Question

我们已配置Grok导出器来监视Web服务日志中的错误。我们看到，即使没有错误，它仍会打印过去的错误数。

我们使用“gauge”作为度量标准类型，并每5秒轮询一次日志文件。

请参阅下面的config.yml：

global:
  config_version: 2
input:
  type: file
  path: /ZAMBAS/logs/Healthcheck/AI/ai_17_grafana.log
  readall: true
  poll_interval_seconds: 5

grok:
  patterns_dir: ./patterns

metrics:
    - type: counter
      name: OutOfThreads
      help: Counter metric example with labels.
      match: '%{GREEDYDATA} WARN!! OUT OF THREADS: %{GREEDYDATA}'

    - type: counter
      name: OutOfMemory
      help: Counter metric example with labels.
      match: '%{GREEDYDATA}: Java heap space'

    - type: gauge
      name: NoMoreEndpointPrefix
      help: Counter metric example with labels.
      match: '%{GREEDYDATA}: APPL%{NUMBER:val1}: IO Exception: Connection refused %{GREEDYDATA}'
      value: '{{.val1}}'
      cumulative: false


    - type: gauge
      name: IOExceptionConnectionReset
      help: Counter metric example with labels.
      match: '   <faultstring>APPL%{NUMBER:val3}: IO Exception: Connection reset'
      value: '{{.val3}}'
      cumulative: false


    - type: gauge
      name: IOExceptionReadTimedOut
      help: Counter metric example with labels.
      match: '   <faultstring>APPL%{NUMBER:val4}: IO Exception: Read timed out'
      value: '{{.val4}}'
      cumulative: false


    - type: gauge
      name: FailedToConnectTo
      help: Counter metric example with labels.
      match: "   <faultstring>RUNTIME0013: Failed to connect to '%{URI:val5}"
      value: '{{.val5}}'
      cumulative: false

server:
port: 9244



Output:

grok_exporter_lines_matching_total{metric="FailedToConnectTo"} 0
grok_exporter_lines_matching_total{metric="IOExceptionConnectionReset"} 0
grok_exporter_lines_matching_total{metric="IOExceptionReadTimedOut"} 3
grok_exporter_lines_matching_total{metric="NoMoreEndpointPrefix"} 0
grok_exporter_lines_matching_total{metric="OutOfMemory"} 0
grok_exporter_lines_matching_total{metric="OutOfThreads"} 0

比如，1小时没有错误，仍然显示“3”错误，当发生错误时，它会不断加起来。所以总共它变成了4等等..它继续添加:(

我希望grok只显示当前数据而不添加以前的值。

请帮助我们，告诉我我做错了什么。

Thanz Cheyutosh

Answer 1

这是正确的行为。你想要做的是使用普罗米修斯的rate()函数来计算每秒有多少相关的日志行。例如rate(OutOfThreads[5m])。