Logparser can not tail file in Windows

[MarkDordoy]

Hi

We have been using the logparser to read our IIS Logs. If we use a wildcard to point to all .log files, it loads all data and sends to influxdb fine. However after initial load no file changes are picked up.

If we point the logparser to one specific file then it does pick up the changes.

Is this a known issue? Is there anyway to use wildcards and have it read the tail.

Please let me know if you would like further information. We are using telegraf v 1.3.2

Our config with some sensitive stuff omitted is below

[global_tags]
  environment = "TEST"

[agent]
  interval = "5s"
  round_interval = true
  flush_buffer_when_full = true
  collection_jitter = "0s"
  flush_interval = "10s"
  flush_jitter = "0s"
  debug = false
  quiet = false
  logfile = "C:\\Program Files\\Telegraf\\telegraf.log"
  hostname = "server1"

[[outputs.influxdb]]

  urls = ["http://influxdb:8086"]
  database = "mydb"
  precision = "s"
  timeout = "15s"
  username = "user"
  password = "password"


[[inputs.logparser]]
  files = ["E:\\Logs\\folder\\W3SVC\\api\\W3SVC28\\*.log"]
  from_beginning = true
  name_override = "test_metric"

[inputs.logparser.grok]
patterns = ['%{TIMESTAMP_ISO8601:timestamp:ts-"2006-01-02 15:04:05"} %{IPORHOST:site} %{WORD:http_method} %{URIPATH:page} %{NOTSPACE:query_string} %{NUMBER:port} %{NOTSPACE:username} %{IPORHOST:client_host} %{NOTSPACE:useragent} %{NUMBER:http_response} %{NUMBER:sub_response} %{NUMBER:sc_status} %{NUMBER:time_taken}']

[MarkDordoy]

I should add, ive done some more testing and it appears it doesnt read the tail of a file even if i point the files config at a single file

Are others able to see the same problem?

[danielnelson]

This may not work in Windows. What I would like to see done is support for the poll watching method added to tail and logparser, as mentioned in #2858

[nikskiz]

Ensure you apply 'watch_method = "poll"' in the logparser input. I.E:

[[inputs.logparser]]
files = ["E:/app/log/app.*"]
from_beginning = false
watch_method = "poll"