mtail VS sloth

You can do that with something like mtail. Basically write expressions that match your logs and produce metrics.

mtail is a standard tool for this.

I use goflow2 to do something like this. I don't specifically use syslog itself for this, but mtail to generate the metrics.

I can recommend mtail. Here is a good example nginx script.

If not, https://github.com/google/mtail might be a good option.

Count the lines with mtail. You can regexp match the values out into labels.

If you want to extract whitebox metrics from logs, maybe all you need is mtail.

You can use mtail (https://github.com/google/mtail) for this. You'll need to figure out how to plug it into your setup, but mtail will do the metrics from logs thing.

Convert your logs to metrics with mtail.

For nginx, you'll need to setup a log parser like mtail because it doesn't really have much for metrics to begin with.

It’s a CLI that allows developers to embed SLO annotation into GO code as comments and generate Prometheus alert groups when paired with Sloth, https://github.com/slok/sloth.

SLOTH: https://github.com/slok/sloth

Note: Although it’s outside of the scope of this post to dig deep into this topic, in case you’re curious, you can check out what an OpenSLO YAML definition looks like here.

The actual hard part is standardizing all teams on SLI/SLO-based thinking. For that we're looking at tools like Sloth.

Have a look at sloth (https://github.com/slok/sloth) which will help you generate SLOs and error budgets given a PromQL query. This might be easier than trying to calculate it yourself. Plus, it's "metrics as code" and OpenSLO spec compliant.

If you are in k8s and use Prometheus you could take a look at sloth: https://github.com/slok/sloth which can either generate the rules/alerts for you, or can run as an operator and allows you to write SLOs as k8s kinds.

Check out https://github.com/slok/sloth