Telegraf JSON Parse Tag Key is an array

Telegraf
1

I am trying to get the ec2Tag_FQDN and processDisplayName fields from this JSON output and add them to my metric as tags, however the keys are stored in the metadata array and only the values are in the results array

{
  "data": {
    "actor": {
      "account": {
        "nrql": {
          "metadata": {
            "eventTypes": [
              "ProcessSample"
            ],
            "facets": [
              "ec2Tag_FQDN",
              "processDisplayName"
            ]
          },
          "results": [
            {
              "facet": [
                "inf-138df57e6",
                "c-icap"
              ],
              "latest.threadCount": 12
            },
            {
              "facet": [
                "inf-94ba037a2",
                "c-icap"
              ],
              "latest.threadCount": 12
            },
            {
              "facet": [
                "inf-138df57e6",
                "clamd@scan"
              ],
              "latest.threadCount": 3
            },
            {
              "facet": [
                "inf-94ba037a2",
                "clamd@scan"
              ],
              "latest.threadCount": 3
            },
            {
              "facet": [
                "inf-138df57e6",
                "icap"
              ],
              "latest.threadCount": 1
            },
            {
              "facet": [
                "inf-94ba037a2",
                "icap"
              ],
              "latest.threadCount": 1
            }
          ]
        }
      }
    }
  }
}

Here is my config

[[inputs.http]]
  ## One or more URLs from which to read formatted metrics
  urls = ["https://api.newrelic.com/graphql"
]

  ## HTTP method
  method = "POST"

  ## Optional HTTP headers
  headers =  **

  body =  **

  ## Data format to consume.
  ## Each data format has its own unique set of configuration options, read
  ## more about them here:
  ## https://github.com/influxdata/telegraf/blob/master/docs/DATA_FORMATS_INPUT.md
  data_format = "json"



  #Parse `results` array only
  json_query = "data.actor.account.nrql.results"

  #Exclude host items from tags
  tagexclude = ["url","host"]
  tag_keys = ["facet"]
2

Hi @Aaron_West1,

You could use our [[processors.rename]] plugin to achieve this. See config below:

[[processors.rename]]
[[processors.rename.replace]]
  tag = "facet_0"
  dest = "ec2Tag_FQDN"

[[processors.rename.replace]]
  tag = "facet_1"
  dest = "processDisplayName"

[[inputs.http]]
  ## One or more URLs from which to read formatted metrics
  urls = ["https://api.newrelic.com/graphql"
]

  ## HTTP method
  method = "POST"

  ## Optional HTTP headers
  headers =  **

  body =  **
  data_format = "json"
  json_query = "data.actor.account.nrql.results"
  tagexclude = ["url","host"]
  tag_keys = ["facet_*"]

I also added _* to utilize glob matching for the tag keys.

The output with the data you provided looked like this:

data,ec2Tag_FQDN=inf-138df57e6,processDisplayName=c-icap latest.threadCount=12 1621451720000000000
data,ec2Tag_FQDN=inf-94ba037a2,processDisplayName=c-icap latest.threadCount=12 1621451720000000000
data,ec2Tag_FQDN=inf-138df57e6,processDisplayName=clamd@scan latest.threadCount=3 1621451720000000000
data,ec2Tag_FQDN=inf-94ba037a2,processDisplayName=clamd@scan latest.threadCount=3 1621451720000000000
data,ec2Tag_FQDN=inf-138df57e6,processDisplayName=icap latest.threadCount=1 1621451720000000000
data,ec2Tag_FQDN=inf-94ba037a2,processDisplayName=icap latest.threadCount=1 1621451720000000000

Let me know if you still have any issues.

Thanks,
Helen

1 Like
3

Thanks

helenosheaa

That got it done