support countinf for multi-field combinations about grok_exporter

[fstab]

Hi, thank you very much! I am not sure if I understand your question exactly. Could you give me an example?

[yesungit]

Appreciate you looking into this. Here is a simplified sample log file, should be self-explained with header:

#Fields: date time method status substatus timetaken
2016-06-15 22:00:00 POST 200 0 404
2016-06-15 22:00:01 POST 404 0 210
2016-06-15 22:00:03 POST 200 0 404
2016-06-15 22:00:11 POST 200 0 300
2016-06-15 22:02:41 POST 200 120 404
2016-06-15 22:02:41 POST 200 0 404
2016-06-15 22:02:41 POST 200 0 240
2016-06-15 22:02:41 POST 200 0 404
2016-06-15 22:02:41 POST 200 0 404
2016-06-15 22:02:42 POST 200 120 512
2016-06-15 22:02:42 POST 200 0 404
2016-06-15 22:02:42 POST 200 0 404
2016-06-15 22:02:43 POST 200 0 120
2016-06-15 22:02:43 POST 200 120 404
2016-06-15 22:02:43 POST 200 0 98
2016-06-15 22:02:43 POST 200 0 404
2016-06-15 22:02:43 POST 200 0 90
2016-06-15 22:02:43 POST 200 0 404
2016-06-15 22:02:44 POST 200 0 120
2016-06-15 22:02:44 OPTIONS 200 0 661
2016-06-15 22:02:44 POST 200 0 404

and snippet of the config file:

metrics:
- type: counter
name: log_status_count
help: Total number of logs, partitioned by status code
match: '%{TIMESTAMP_ISO8601:log_timestamp} %{WORD:method} %{NUMBER:response} %{NUMBER:subresponse} %{NUMBER:timetaken}'
labels:
- grok_field_name: response
prometheus_label: http_status_code
- type: counter
name: log_substatus_count
help: Total number of logs, partitioned by substatus code
match: '%{TIMESTAMP_ISO8601:log_timestamp} %{WORD:method} %{NUMBER:response} %{NUMBER:subresponse} %{NUMBER:timetaken}'
labels:
- grok_field_name: subresponse
prometheus_label: http_substatus_code

[fstab]

Thanks for the example. It is currently not possible to combine multiple grok fields into one Prometheus label. I think it would be a useful feature though, and I am planning to do a new release between Christmas and New Year's, so it should be possible soon :)

In the meantime, if the two fields are next to each other as in your simplified log, you could define a Grok pattern spanning both fields, like RESPONSE_AND_SUBRESPONSE %{NUMBER:response} %{NUMBER:subresponse}. Then you could use %{RESPONSE_AND_SUBRESPONSE:response_and_subresponse} in the metrics config.

[fstab]

I just released v0.2.0, which introduces a more flexible way to define labels using templates. You can now define a label like this:

labels:
    http_status: '{{.response}}.{{.subresponse}}'

which should produce label values like 200.0.

[fstab]

Release v0.2.1 has even better support for templates. Closing this issue, all kinds of field combinations as label values should work now.