IPVS and Apache Druid Integration

Input and output integration overview

The IPVS plugin is designed to collect metrics related to IPVS virtual and real servers on Linux systems.

This plugin allows Telegraf to send JSON-formatted metrics to Apache Druid over HTTP, enabling real-time ingestion for analytical queries on high-volume time-series data.

Integration details

IPVS

The IPVS plugin gathers metrics about IPVS virtual and real servers using the Linux kernel netlink socket interface. As a component specifically designed for Linux, it tracks performance related to IP virtual servers, allowing users to monitor various attributes such as active connections, packet statistics, and byte counts. Key metrics include those for both virtual and real servers, facilitating a comprehensive view of server performance. The plugin also requires the Telegraf process to run with appropriate permissions, typically as root or a user with specific capabilities for proper operation.

Apache Druid

This configuration uses Telegraf’s HTTP output plugin with json data format to send metrics directly to Apache Druid, a real-time analytics database designed for fast, ad hoc queries on high-ingest time-series data. Druid supports ingestion via HTTP POST to various components like the Tranquility service or native ingestion endpoints. The JSON format is ideal for structuring Telegraf metrics into event-style records for Druid’s columnar and time-partitioned storage engine. Druid excels at powering interactive dashboards and exploratory queries across massive datasets, making it an excellent choice for real-time observability and monitoring analytics when integrated with Telegraf.

Configuration

IPVS

[[inputs.ipvs]]
  # no configuration

Apache Druid

[[outputs.http]]
  ## Druid ingestion endpoint (e.g., Tranquility, HTTP Ingest, or Kafka REST Proxy)
  url = "http://druid-ingest.example.com/v1/post"

  ## Use POST method to send events
  method = "POST"

  ## Data format for Druid ingestion (expects JSON format)
  data_format = "json"

  ## Optional headers (may vary depending on Druid setup)
  # [outputs.http.headers]
  #   Content-Type = "application/json"
  #   Authorization = "Bearer YOUR_API_TOKEN"

  ## Optional timeout and TLS settings
  timeout = "10s"
  # tls_ca = "/path/to/ca.pem"
  # tls_cert = "/path/to/cert.pem"
  # tls_key = "/path/to/key.pem"
  # insecure_skip_verify = false

Input and output integration examples

IPVS

1. Load Balancing Performance Monitoring: Use the IPVS plugin to monitor the performance of a load balancing setup in a Linux environment where IPVS is implemented. By collecting metrics such as byte counts, packet rates, and active connections, administrators can gain real-time insights into server performance, allowing for proactive adjustments to load distribution strategies and ensuring that no individual server becomes a bottleneck.

2. Automated Alerting for Connection Thresholds: Integrate the metrics collected by the IPVS plugin with an alerting system to automatically notify administrators when active connections exceed or fall below specified thresholds. This use case enables dynamic scaling of backend resources, optimizing application performance and resource utilization, while minimizing the risk of sudden service disruptions.

3. Historical Performance Trend Analysis: Store the metrics gathered by the IPVS plugin in a time-series database for historical analysis. By analyzing trends over time, organizations can identify patterns in server performance, correlate them with application usage spikes, and make informed decisions regarding infrastructure upgrades or maintenance schedules to better handle peak loads.

Apache Druid

1. Real-Time Application Monitoring Dashboard: Use Telegraf to collect metrics from application servers and send them to Druid for immediate analysis and visualization in dashboards. Druid’s low-latency querying allows users to interactively explore system behavior in near real-time.

2. Security Event Aggregation: Aggregate and forward security-related metrics such as failed logins, port scans, or process anomalies to Druid. Analysts can build dashboards to monitor threat patterns and investigate incidents with millisecond-level granularity.

3. IoT Device Analytics: Collect telemetry from edge devices via Telegraf and send it to Druid for fast, scalable processing. Druid’s time-partitioned storage and roll-up capabilities are ideal for handling billions of small JSON events from sensors or gateways.

4. Web Traffic Behavior Exploration: Use Telegraf to capture web server metrics (e.g., requests per second, latency, error rates) and forward them to Druid. This enables teams to drill down into user behavior by region, device, or request type with subsecond query performance.

Feedback

Thank you for being part of our community! If you have any general feedback or found any bugs on these pages, we welcome and encourage your input. Please submit your feedback in the InfluxDB community Slack.