Telegraf measurement values and strings

Telegraf
1

I’m collecting some stats using Telegraf via SNMP.

I wasn’t able to get the data points in Grafana so had a look at Influx and can see the following. Is the issue that the stored value is “-67 dBm” and if so, how do I remove the “dBm” part from being stored?

select RSSI, value from 3GTable
name: 3GTable
time RSSI value

1538672523000000000 -67 dBm
1538672564000000000 -67 dBm
1538672629000000000 -67 dBm

2

You should be able to clean this up using the regex followed by the converter processors. Use the namepass option on both processors to select only the 3GTable measurement and also remember to define the order of the processors.

3

Sorry I’m very new to these tools. Can you please point me in the direction of an example? It would be much appreciated.

Thanks

4

I probably don’t have a good example in the docs right now, but I think this would do the job:

[[processors.regex]]
  namepass = "3GTable"
  order = 1
  [[processors.regex.fields]]
    key = "RSSI"
    pattern = "[^ ]+ dBm"
    replacement = "${1}"

[[processors.converter]]
  namepass = "3GTable"
  order = 2
  [processors.converter.fields]
    float = ["RSSI"]

You will want to reference the regex and converter processor documentation.

5

Doesn’t seem to work.

I tried the debug to see what its recording and its just shows RSSI=“Unknown”

Do i need anything under the inputs with this? here is what I have

[[inputs.snmp.table]]
name = “3GTable”
inherit_tags = [ “hostname” ]
oid = “HUAWEI-WAN-MIB::3GTable”

[[inputs.snmp.field]]
name = “RSSI”
oid = “HUAWEI-WAN-MIB::RSSI.9”
is_tag = true

6

Since RSSI is being created as a tag, not a field, you would need to modify the regex processor to operate on the tag:

- [[processors.regex.fields]]
+ [[processors.regex.tags]]

The converter plugin should be removed, no need to change the type because tags are always strings.

7

Understood. I made those changes.

If i use the telegraf --test --debug would I expect to see just the value in the output i.e. -67 instead of -67 dBM or does this happen after collection?

At present it still shows -67 dBm, but i’m not sure if that’s to be expected?

Thank you very much for your help so far.

Dan.

8

This is expected, currently the --test function only runs the inputs, and skips the processors, aggregators, and outputs. For end to end testing I usually swap out my real output for a file output.

9

Hi have a similar problem, but am not sure if the regex processor behaves correctly or my approach is not correct.
I want to create tags for IPv4 or IPv6 log entries (I use tail plugin with grok parsing), but don’t want to keep the real IPs.
What I do is:

[[processors.regex]]
   #process all access_log measurements
   namepass = "*access_lo*"
   order = 1
   ## Tag and field conversions defined in a separate sub-tables
   [[processors.regex.tags]]
      ## Tag to change
      key = "client_ip"
      ## Regular expression to match on a tag value
      pattern = "^([0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.]"
      ## Pattern for constructing a new value (${1} represents first subgroup)
      replacement = "ipv4"

So I just want to have only ipv4 (or ipv6) in the tag client_ip. But the output for client_ip is e.g.:
ipv456.174.137

So without specifing it, it outputs “ipv4${1}” isn’t it ? Is this intended behavior or a bug ? How can I achieve my goal ?

10

After some testing it seems that the plugin outputs the unmatched part of the tag value at the end of the replacement string, what makes no sense to me. But if I build some pattern with non-capturing groups for the whole value then it is not happening. Maybe the clue is to have a full pattern that matches everything not parts of the value. This works for me:

[[processors.regex]]
#process all access_log measurements
namepass = [“access_log”]
order = 1
[[processors.regex.tags]]
## Tag to change
key = “client_ip”
## Regular expression to match on a tag value
pattern = “^(?:^\d+[.])(?:.*)$”
## Pattern for constructing a new value (${1} represents first subgroup)
replacement = “ipv4”

[[processors.regex]]
#process all access_log measurements
namepass = [“access_log”]
order = 2
[[processors.regex.tags]]
## Tag to change
key = “client_ip”
## Regular expression to match on a tag value
pattern = “^(?:[0-9A-Fa-f]{1,4}:)(?:.*)$”
## Pattern for constructing a new value (${1} represents first subgroup)
replacement = “ipv6”

11

Maybe this is a bit old and changed now, but if ‘tags are always strings’, what is the point of [processors.converter.tags]?

12

This will allow you to convert a tag to a field type, during conversion the string tag is reinterpreted as the target type. If you have a tag that is answer=42 you could convert it to an integer field, but if the tag is host=example.org you can only convert it to a string field without error.

13

Sorry to use this old topic but am facing a challenge, I could convert a tag “Core_Count” to a field type integer in the measurement.

Getting the following error
2020/01/08 16:11:41 E! Error parsing telegraf.conf, Undefined but requested processor: converter

telegraf.conf

[[inputs.win_perf_counters.object]]
ObjectName = “CPU”
Measurement = “CPU”
Instances = [“*”]
IncludeTotal=true
Counters = [
“% Idle Time”,
“% Processor Time”,
]
[inputs.win_perf_counters.tags]
Core_Count=“0”

[[processors.converter]]
	[processors.converter.tags]
	integer = ["Core_Count"]
14

Resolved.
I was using older telegraf version.