Suggested template:
I’m setting up a netdata agent to get logs from a syslog file (drupal syslog, if it matters) in /var/log/drupal-oauth2.log
Snippet of logs
normal logs
Aug 10 16:32:04 vmin drupal_oauth2: http://default|1754832724|6|cron|127.0.0.1|http://default/||0||Starting execution of field_cron().
Aug 10 16:32:04 vmin drupal_oauth2: http://default|1754832724|6|cron|127.0.0.1|http://default/||0||Starting execution of file_cron(), execution of field_cron() took 4.66ms.
Aug 10 16:32:04 vmin drupal_oauth2: http://default|1754832724|6|cron|127.0.0.1|http://default/||0||Starting execution of node_cron(), execution of file_cron() took 42.38ms.
Aug 10 16:32:04 vmin drupal_oauth2: http://default|1754832724|6|cron|127.0.0.1|http://default/||0||Starting execution of oauth2_esnaccounts_cron(), execution of node_cron() took 0.01ms.
Aug 10 16:32:04 vmin drupal_oauth2: http://default|1754832724|4|oauth2_esnaccounts|127.0.0.1|http://default/||0||Warning message
Aug 10 16:32:04 vmin drupal_oauth2: http://default|1754832724|6|oauth2_esnaccounts|127.0.0.1|http://default/||0||Info message
Aug 10 16:32:04 vmin drupal_oauth2: http://default|1754832724|3|oauth2_esnaccounts|127.0.0.1|http://default/||0||Error message
Aug 10 16:32:04 vmin drupal_oauth2: http://default|1754832724|1|oauth2_esnaccounts|127.0.0.1|http://default/||0||alert message
Aug 10 16:32:04 vmin drupal_oauth2: http://default|1754832724|2|oauth2_esnaccounts|127.0.0.1|http://default/||0||Critical message
The syslog format set is this.
!base_url|!timestamp|!severity|!type|!ip|!request_uri|!referer|!uid|!link|!message
In the beginning, the logs were being sent in netdata but after a while I saw the file (tail -f) they were duplicate entries there, but only the MESSAGE (!message) part
Duplicate logs
Aug 10 16:41:03 vmin drupal_oauth2: http://default|1754833263|6|cron|127.0.0.1|http://default/||0||Starting execution of field_cron().
Aug 10 16:41:03 vmin drupal_oauth2: http://default|1754833263|6|cron|127.0.0.1|http://default/||0||Starting execution of file_cron(), execution of field_cron() took 0.58ms.
Aug 10 16:41:03 vmin drupal_oauth2[3917596]: Starting execution of field_cron().
Aug 10 16:41:03 vmin drupal_oauth2: http://default|1754833263|6|cron|127.0.0.1|http://default/||0||Starting execution of node_cron(), execution of file_cron() took 18.23ms.
Aug 10 16:41:03 vmin drupal_oauth2: http://default|1754833263|6|cron|127.0.0.1|http://default/||0||Starting execution of oauth2_esnaccounts_cron(), execution of node_cron() took 0.01ms.
Aug 10 16:41:03 vmin drupal_oauth2: http://default|1754833263|4|oauth2_esnaccounts|127.0.0.1|http://default/||0||Warning message
Aug 10 16:41:03 vmin drupal_oauth2: http://default|1754833263|6|oauth2_esnaccounts|127.0.0.1|http://default/||0||Info message
Aug 10 16:41:03 vmin drupal_oauth2: http://default|1754833263|3|oauth2_esnaccounts|127.0.0.1|http://default/||0||Error message
Aug 10 16:41:03 vmin drupal_oauth2: http://default|1754833263|1|oauth2_esnaccounts|127.0.0.1|http://default/||0||alert message
Aug 10 16:41:03 vmin drupal_oauth2: http://default|1754833263|2|oauth2_esnaccounts|127.0.0.1|http://default/||0||Critical message
Aug 10 16:41:03 vmin drupal_oauth2: http://default|1754833263|6|cron|127.0.0.1|http://default/||0||Starting execution of system_cron(), execution of oauth2_esnaccounts_cron() took 0.72ms.
Aug 10 16:41:03 vmin drupal_oauth2: http://default|1754833263|6|cron|127.0.0.1|http://default/||0||Starting execution of update_cron(), execution of system_cron() took 13.11ms.
Aug 10 16:41:03 vmin drupal_oauth2[3917596]: Starting execution of file_cron(), execution of field_cron() took 0.58ms.
Aug 10 16:41:03 vmin drupal_oauth2: http://default|1754833263|6|cron|127.0.0.1|http://default/||0||Execution of update_cron() took 22.25ms.
Aug 10 16:41:03 vmin drupal_oauth2[3917596]: Starting execution of node_cron(), execution of file_cron() took 18.23ms.
Aug 10 16:41:03 vmin drupal_oauth2: http://default|1754833263|6|cron|127.0.0.1|http://default/||0||Cron run completed.
Aug 10 16:41:03 vmin drupal_oauth2[3917596]: Starting execution of oauth2_esnaccounts_cron(), execution of node_cron() took 0.01ms.
Aug 10 16:41:03 vmin drupal_oauth2[3917596]: Warning message
Aug 10 16:41:03 vmin drupal_oauth2[3917596]: Info message
Aug 10 16:41:03 vmin drupal_oauth2[3917596]: Error message
Aug 10 16:41:03 vmin drupal_oauth2[3917596]: alert message
Aug 10 16:41:03 vmin drupal_oauth2[3917596]: Critical message
Aug 10 16:41:03 vmin drupal_oauth2[3917596]: Starting execution of system_cron(), execution of oauth2_esnaccounts_cron() took 0.72ms.
Aug 10 16:41:03 vmin drupal_oauth2[3917596]: Starting execution of update_cron(), execution of system_cron() took 13.11ms.
Aug 10 16:41:03 vmin drupal_oauth2[3917596]: Execution of update_cron() took 22.25ms.
Aug 10 16:41:04 vmin drupal_oauth2[3917596]: Cron run completed.
Relevant docs you followed/actions you took to solve the issue
Looking into log2journal | Learn Netdata
Environment/Browser/Agent’s version etc
netdata v2.6.1
Netdata log2journal v2.6.1
What I expected to happen
Nothing else should write in /var/log/drupal-oauth2.log except my web app