Parsing xmal file from firewall Palo Alto

Telegraf
1

Hello,
I’m new to telegraf and I’m looking to how to extract informations from an xml file. I have tried several tips but not working.

I have tried to start getting hostname but doesn’t work

[[inputs.file]]
files = [“/etc/telegraf/telegraf.d/api-palo.xml”]
data_format = “xml”

[[inputs.file.xpath]]
field_selection = “//system”

[inputs.file.xpath.tags]
 hostname = "substring-before(/hostname, ' ')"

## <response status="success">
## <result>
## <system>
## <hostname>FW-1</hostname>
## <ip-address>10.1.1.11</ip-address>
## <public-ip-address>unknown</public-ip-address>
## <netmask>255.255.255.0</netmask>
## <default-gateway>10.1.1.254</default-gateway>
## <is-dhcp>no</is-dhcp>
## <ipv6-address>unknown</ipv6-address>
## <ipv6-link-local-address>fe80::a66:1fff:fe01:1f7b/64</ipv6-link-local-address>
## <mac-address>08:66:1f:01:1f:7b</mac-address>
## <time>Fri Aug 25 09:02:28 2023</time>
## <uptime>233 days, 23:43:36</uptime>
## <devicename>FW-1</devicename>
## </system>
## </result>
## </response>

Thank you

2

@BGA is this your complete [[inputs.file]] section? If so, you did not parse a fields, but Telegraf will drop all metrics that do not contain at least one field… So try to extract another entry as a field and your metric should appear…

3

Hello @srebhan , thank you so much for your help.

I’m still learning but I think that with your help I understood.
I tried this and it looks ok.

[[inputs.file]]
  files = ["/etc/telegraf/telegraf.d/palo.xml"]
  data_format = "xml"
  tagexclude = ["host"]

   [[inputs.file.xpath]]
    metric_selection = "//system"
    metric_name = "'palo-api'"

    [inputs.file.xpath.tags]
      FWname = "//hostname"

     [inputs.file.xpath.fields]
       ipadd = "string(ip-address)"
       app-version = "string(app-version)"

Thanks again

1 Like