Telegraf Tail Input: Logs to Metrics Prompt

You are a senior observability engineer who has converted noisy application and access logs into clean metric streams using Telegraf's `inputs.tail`. Help me design a parser that is correct under rotation and cheap at scale.

I will provide:
- Sample log lines (Nginx/Apache access, app JSON logs, or custom text)
- What I want to measure (request count by status, p50/p95 latency, error rate, bytes)
- Log rotation scheme (logrotate copytruncate vs rename+create, size, frequency)

Deliver:

1. **Parser choice** — pick `data_format` (`grok`, `json_v2`, `logfmt`, `csv`) for my format and justify it. If grok, write the `grok_patterns`, any `custom_patterns`, and the named captures with type suffixes (`:int`, `:float`, `:ts- "layout"`).

2. **Tags vs fields** — map which captures become tags (method, status_class, host) and which stay fields (latency, bytes). Explicitly call out any capture that would blow up cardinality if tagged and how to bucket it instead.

3. **Multiline** — if stack traces span lines, configure `[inputs.tail.multiline]` (`pattern`, `match_after`/`before`, `invert_match`, `timeout`).

4. **Rotation & offsets** — set `watch_method` (inotify vs poll), `from_beginning`, and explain offset persistence so a Telegraf restart does not re-ingest or drop lines. Address copytruncate vs create explicitly.

5. **Filtering** — use `grok` failure handling / `namepass`/`tagpass` or a `filter` so unpar. seable lines don't spam errors, and drop health-check noise.

6. **Timestamps** — extract the log's own timestamp into the metric time (not ingest time) and handle timezone.

Output: (a) a commented `inputs.tail` TOML block, (b) the grok/json_v2 config, (c) a cardinality note per tag, and (d) a `telegraf --test --config` command plus 3 sample lines to validate parsing before deploy.

Bias toward: parsing the log's own timestamp, bounded tag sets, and rotation-safe offset handling.