Processors.regex.tag_rename not keeping original tag

Telegraf
1

I’m using Telegraf to collect data from a network device using the gnmi input plugin.

I’m receiving data like this:

{
  "fields": {
    "lsps/constrained_path/tunnels/tunnel/state/counters/byteRate": 0,
    "lsps/constrained_path/tunnels/tunnel/state/counters/bytes": 1234,
    "lsps/constrained_path/tunnels/tunnel/state/counters/packetRate": 0,
    "lsps/constrained_path/tunnels/tunnel/state/counters/packets": 10
  },
  "name": "lsps",
  "tags": {
    "/mpls/lsps/constrained-path/tunnels/tunnel/state/counters/name": "oc-123456",
    "component": "aftd-trio",
    "component_id": "1",
    "host": "gnmi-deployment-telegraf-agent",
    "interface-name": "device1-device2-0-XE",
    "path": "/mpls/lsps/constrained-path/tunnels/tunnel/state/counters",
    "sub_component_id": "0",
    "source": "networkdevice1.mgt.net"
  },
  "timestamp": 1707409986
}

This is my telegraf.conf:

[global_tags]
[agent]
  round_interval = true
  metric_batch_size = 1000
  metric_buffer_limit = 500000
  flush_interval = "10s"
  debug = false
  quiet = false
  hostname = "telegraf-agent"
  omit_hostname = false


[[inputs.gnmi]]
  addresses = ["device1.mgt.net"]
  username = "$user"
  password = "$password"
  encoding = "proto"
  redial = "10s"
  enable_tls = true
  tls_ca = "/etc/telegraf/router_ca.pem"
  insecure_skip_verify = true
  vendor_specific = ["juniper_header"]
  [inputs.gnmi.aliases]
    optics = "/interfaces"
    opticsVendor = "/components"
    lsps = "/mpls"
[[inputs.gnmi.subscription]]
      name = "lsps"
      origin = "openconfig-interfaces"
      path = "/junos/services/label-switched-path/usage/"
      subscription_mode = "sample"
      sample_interval = "60s"

[[processors.rename]]
  [[processors.rename.replace]]
      tag = "name"
      dest = "interface-name"

[[processors.regex]]
namepass = ["lsps"]
  [[processors.regex.tag_rename]]
    pattern = "source"
    replacement = "system-id"
    result_key = "keep"

[[outputs.file]]
  files = ["stdout"]

I have specified the result_key = "keep", because I want to keep the original tag, however, the original tag source is not coming through. Only the replacement tag system-id is coming through and is assigned the value of source. I’m expecting to see both source and system-id come through as tags with the same value.

I have replicated this on Docker Telegraf Alpine versions 1.28.5 and 1.29.3.

2

Well as the documentation says:

Optionally, the result_key can be set to either overwrite or keep (default) to control the behavior in case the target tag/field already exists

This controls what the plugin does if the rename target already exists!

You should use

[[processors.regex]]
  namepass = ["lsps"]
  [[processors.regex.tags]]
    key = "source"
    result_key = "system-id"
    pattern = "(.*)"
    replacement = "${1}"

instead.

1 Like