Hi,
We just started collecting iptables metrics with iptables telegraf input and sending them to the graphite output.
Here are the config of one node:
[global_tags]
location = "dc1"
tier = "live"
role = "intfw"
lsbdistdescription = "wheezy"
[agent]
hostname = "intfw1-test"
[[processors.regex]]
namepass = ["iptables"]
[[processors.regex.tags]]
key = "ruleid"
pattern = "[:.,\\s]"
replacement = "_"
[[outputs.graphite]]
prefix = "telegraf"
template = "host.tags.measurement.field"
[[inputs.iptables]]
table = "filter"
chains = ["INPUT","FORWARD","OUTPUT"]
As the result of such config we expect graphite fields hierarchy like this:
telegraf ( == outputs.graphite prefix )
└── intfw1-test ( == host from outputs.graphite template )
└── dc1 ( == first global tag from outputs.graphite template tags (global_tags.location))
└── live ( == global_tags.tier)
└── intfw ( == global_tags.role)
└── wheezy ( == global_tags.lsbdistdescription )
└── iptables ( == measurment(inputs.iptables))
└── filter ( == first tag from inputs.iptables, table)
└── INPUT( == 2nd tag from inputs.iptables, chain)
└── allow_monitoring ( == 3rd tag from inputs.iptables, ruleid)
└── pkts.wsp (field)
but, at fact, we’re getting this structure:
telegraf
└── intfw1-test
└── INPUT
└── dc1
└── wheezy
└── intfw
└── allow_monitoring
└── filter
└── live
└── iptables
└── pkts.wsp
i.e. global_tags and tags from iptables.input get mixed in some weird way. Is there any opportunity to control such hierarchy from telegraf configuration?
