Telegraf: Processor Plugins

Regex Processor Plugin

The regex plugin transforms tag and field values with regex pattern. If result_key parameter is present, it can produce new tags and fields from existing ones.
For tags transforms, if append is set to true, it will append the transformation to the existing tag value, instead of overwriting it.

Example: Extract the VMNames from tag "instance" and create a new tag "VMName"

Input "win_perf_counters configuration (Telegraf input config file "inputs.win_perf.hyper-v.conf")

I have the following Windows Perfmon input/configuration to monitoring the load of the VMs for each virtual Core (vCore):

 [[inputs.win_perf_counters.object]]
 ObjectName = "Hyper-V Hypervisor Virtual Processor"
 Instances = ["*"]
 Measurement = "hyperv_processor"
 Counters = [
   "% Total Run Time",
 ] 

Assumption/Example:

• I have two VMs ("TestRHE01" and "TestRHE02")
• The VM "TestRHE01" has four vCores
• The VM "TestRHE01" has two vCores

With the win_perf configuration, showing above, the tag instance has the following value:

"<VMName>:Hv VP <CoreNumber>"

That means we have following metrics:

hyperv_processor,instance="TestRHE01:Hv VP 01" Percent_Total_Run_Time=10%
hyperv_processor,instance="TestRHE01:Hv VP 02" Percent_Total_Run_Time=30%
hyperv_processor,instance="TestRHE01:Hv VP 03" Percent_Total_Run_Time=20%
hyperv_processor,instance="TestRHE01:Hv VP 04" Percent_Total_Run_Time=20%
hyperv_processor,instance="TestRHE02:Hv VP 01" Percent_Total_Run_Time=10%
hyperv_processor,instance="TestRHE02:Hv VP 02" Percent_Total_Run_Time=70%

What we want
Extract the VMName in the tag instance as a new tag VMName, and now the Telegraf regex processor plugin comes into the game.

Processor to extract the VMName as a new tag (Telegraf processor config file "processors.regex.global.conf")

 [[processors.regex]]
   namepass = ["hyperv_processor"]
   
   [[processors.regex.tags]]
     key = "instance"
     pattern = '^(?P<VMName>.+)\:.+$'
     replacement = "${VMName}"
     result_key = "VMName" 

Regex explanation:

The ?P<> is a named group in the Golang-regex

Further use - Grafana

Because you have the VMName extracted from the tag instance, you are able to group by the VNName.
In our example we want the vCPU load in percentage for each VM and not foreach virtual core of a VM.

Troubleshooting

Error: [telegraf] Error running agent: Error parsing <C:\your_config_file_path>, line x: invalid TOML syntax

Example: Configuration with the error:

 [[processors.regex]]
   namepass = ["hyperv_processor"]
  
   [[processors.regex.tags]]
     key = "instance"
     pattern = "^(?P<VMName>.+)\:.+$"
     replacement = "${VMName}"
     result_key = "VMName" 

Solution: Write the "pattern" between singleqoutes instead between doublequotes

Example: Configuration without the error:

 [[processors.regex]]
   namepass = ["hyperv_processor"]
  
   [[processors.regex.tags]]
     key = "instance"
     pattern = '^(?P<VMName>.+)\:.+$'
     replacement = "${VMName}"
     result_key = "VMName"