Telegraf [processors.starlark]: how to assign a process name (string) to the metric.fields

Telegraf
1

My telegraf config file uses the plugin [[inputs.snmp]] to get the process names in the process table:
name = “snmp”
[[inputs.snmp.table.field]]
name = “hrSWRunName”
oid = “.1.3.6.1.2.1.25.4.2.1.4”

Then, uses the plugin [[processors.starlark]] to select the processes that we are interested in to set the value if it is running:
def apply(metric):
proc_name = metric.fields.get(‘hrSWRunName’)
if proc_name == “crond”:
metric.fields[‘crond’] = 1
return metric
if (proc_name).startswith(“Pronghorn Service”):
metric.fields[‘Pronghorn Service’] = “Pronghorn Service”
return metric

The starlark codes above works for the process “crond” and the field “crond” in Influxdb contains value “1”. The codes above for the process “Pronghorn Service” (here part of the process name after “Pronghorn Service” is cut) is also works if set “metric.fields[‘Pronghorn Service’] = 1” and the field “Pronghorn Service” contains “1” in the Influxdb. However, if the field “Pronghorn Service” is set to “Pronghorn Service” as shown in the code above or other string, the field “Pronghorn Service” contains no data (empty) in the Influxdb.

Any comment or suggestion to get the field “Pronghorn Service” in Influxdb containing the process name (string)? Thanks!

2

For all changes you want to do, there is no need to use starlark.

First of all I would make the hrSWRunName field a tag with is_tag = true.

Then you can use metric filtering techniques as shown in the docs: telegraf/config at master · influxdata/telegraf · GitHub

Its not clear what you want to achieve with the second part of your starlark code, but have a look at the rename processor maybe? Or the regex one.

3

@Hipska, thanks for the response!

Actually, the first part for process “crond” works fine as designed. The second part is to try to determine whether a process is running. This process name contains the timestamp like “Pronghorn Service_20220125_120303”. If this process is running (found in the process table), write the entire process name into InfluxDB under the field name “Pronghorn Service”. For testing purpose, I hardcoded “Pronghorn Service” without adding the timestamp as the process name to the field “Pronghorn Service” and tried to write it to InfluxDB. However, I did not see “Pronghorn Service” is shown under the field “Pronghorn Service” in InfluxDB. If I set the field to “1” in starlark, the field “Pronghorn Service” contains “1” in InfluxDB, if the process is running.

4

I think the problem is that the name of the field has a space in it…

5

Even I removed the space in “Pronghorn Service”, I still did not see “PronghornService” written into the field “PronghornService” in InfluxDB . I see the following errors in the log:
2022-02-28T15:41:31Z E! [processors.starlark] Error: NoneType has no .startswith field or method
2022-02-28T15:41:31Z E! [processors.starlark] Error in plugin: NoneType has no .startswith field or method

It looks like this is a data type issue (writing a string to the field) by adding the starlark codes below in the [[processors.starlark]]
if (proc_name).startswith(“PronghornService”):
metric.fields[‘PronghornService’] = “PronghornService”
return metric

Any suggestion to resolve this issue?

6

@xl3121

  1. no idea if this is relevant, but remove the brackets around (proc_name)
  2. look at the real data in Telegraf, e.g. with the file output plugin. If there is no field hrSWRunName in some of the metrics, the starlark script will crash of course. Then you may have to change the script.
7

@Franky1, thanks for the suggestion. I removed the brackets around (proc_name), but still got “Error: NoneType has no .startswith field or method” in the log. So I changed the query option, and I finally saw the whole process name written into the Influx DB. It seems the message " “Error: NoneType has no .startswith field or method” did not cause a problem, and the starlark script works as coded.