How to drop all fields and tags for a specific event if a field:value is matched?

1

Hi,

I have telemetry metrics coming from an optical device and I want to drop all the fields and tags if a certain value is seen.

Example:

components,host=lab-telegraf-agent,slot=PSU-1,source=10.0.0.10 type="POWER_SUPPLY" 1668706983000000000

If slot is PSU-1 or if type is POWER_SUPPLY, I want to drop this entire event. I don’t want any of this data to be sent to the output. Any event that doesn’t match this I’d like to keep.

I’m trying to work with the starlark plugin but can’t get it to work:

[[processors.starlark]]
 source = '''
load("logging.star", "log")
def apply(metric):
  for k, v in metric.fields.items():
    if v in ["PSU-1", "POWER_SUPPLY"]:
        log.debug("Key: {}".format(k))
        log.debug("Value: {}".format(v))
        return None
  return metric

I don’t have to use the starlark plugin if this is possible with any other plugin.

Thank you.

2

you just need some filtering, Have a look at tagdrop and fielddrop

3

Thanks, it looks like I can only use tagpass and tagdrop to filter based on the value of the field. fieldpass and fielddrop do not evaluate the value of the field.