Squid

nohup  ./squid-exporter -squid-hostname "localhost" -squid-port 3128 -listen ":9301" &

cd /usr/local/datakit/conf.d/samples/
cp prom.conf.sample squid.conf

  ## Exporter URLs.
  urls = ["http://127.0.0.1:9301/metrics"]
  ## Stream Size. 
  ## The source stream segmentation size, (defaults to 1).
  ## 0 source stream undivided. 
  # stream_size = 1
  ## Unix Domain Socket URL. Using socket to request data when not empty.
  uds_path = ""
  ## Ignore URL request errors.
  ignore_req_err = false
  ## Collector alias.
  source = "squid-prom"
  ...

cp logging.conf.sample squid.conf

[[inputs.logging]]
  # List of log files, supports batch specification using glob patterns.
  # It is recommended to use absolute paths and specify file extensions.
  # Narrow the scope as much as possible to avoid collecting unexpected files.
  logfiles = [
    "/var/log/squid/access.log",
    "/var/log/squid/cache.log"
  ]
  ## Socket currently supports two protocols: tcp/udp. It is recommended to use internal
  ## network ports for security.
  sockets = [
   #"tcp://0.0.0.0:9540",
   #"udp://0.0.0.0:9541",
  ]
  # File path filtering using glob patterns, any file matching these patterns will not be collected
  ignore = [""]
  # Logging source, defaults to 'default' if empty
  source = "squid"
  ...

grok(_, "%{NUMBER:timestamp:float}%{SPACE}%{INT:response_time:int}%{SPACE}%{IP:client_ip}%{SPACE}%{WORD:squid_result}/%{INT:http_status:int}%{SPACE}%{INT:bytes:int}%{SPACE}%{WORD:method}%{SPACE}%{NOTSPACE:uri}%{SPACE}-%{SPACE}(?:%{WORD:hier_status}/%{NOTSPACE:hier_ip}|%{NOTSPACE:hier_full})%{SPACE}%{GREEDYDATA:content_type}")

client_ip = get_key("client_ip")
if client_ip {
  add_key("log_type", "squid_access")
  geoip("client_ip")
}

grok(_, "%{DATE:d} %{TIME:t} %{WORD:process}(?:\\|)%{GREEDYDATA:raw_msg}")

if (raw_msg){
  if ( "ERROR" in raw_msg ){
    add_key("status","error")
  }
  drop_key("raw_msg")
  add_key("log_type","squid_cache")
}

if d {
 default_time("d + t", "2006/01/02 15:04:05") 
  drop_key("d")
  drop_key("t")
}

2025/08/28 09:37:35 kid1| Logfile: opening log stdio:/var/spool/squid/netdb.state
2025/08/28 09:37:35 kid1| Logfile: closing log stdio:/var/spool/squid/netdb.state
2025/08/28 09:37:35 kid1| NETDB state saved; 9 entries, 0 msec
2025/08/28 10:14:17 pinger| SendEcho ERROR: sending to ICMPv6 packet to [2606:4700::6812:1dd6]: (101) Network is unreachable
2025/08/28 10:21:29 kid1| Logfile: opening log stdio:/var/spool/squid/netdb.state
2025/08/28 10:21:29 kid1| Logfile: closing log stdio:/var/spool/squid/netdb.state
2025/08/28 10:21:29 kid1| NETDB state saved; 9 entries, 0 msec