Kinesis and OpenObserve Integration

Input and output integration overview

The Kinesis plugin enables you to read from Kinesis data streams, supporting various data formats and configurations.

This configuration pairs Telegraf’s HTTP output with OpenObserve’s native JSON ingestion API, turning any Telegraf agent into a first-class OpenObserve collector.

Integration details

Kinesis

The Kinesis Telegraf plugin is designed to read from Amazon Kinesis data streams, enabling users to gather metrics in real-time. As a service input plugin, it operates by listening for incoming data rather than polling at regular intervals. The configuration specifies various options including the AWS region, stream name, authentication credentials, and data formats. It supports tracking of undelivered messages to prevent data loss, and users can utilize DynamoDB for maintaining checkpoints of the last processed records. This plugin is particularly useful for applications requiring reliable and scalable stream processing alongside other monitoring needs.

OpenObserve

OpenObserve is an open source observability platform written in Rust that stores data cost-effectively on object storage or local disk. It exposes REST endpoints such as /api/{org}/ingest/metrics/_json that accept batched metric documents conforming to a concise JSON schema, making it an attractive drop-in replacement for Loki or Elasticsearch stacks. The Telegraf HTTP output plugin streams metrics to arbitrary HTTP targets; when the "data_format = "json"" serializer is selected, Telegraf batches its metric objects into a payload that matches OpenObserve’s ingestion contract. The plugin supports configurable batch size, custom headers, TLS, and compression, allowing operators to authenticate with Basic or Bearer tokens and to enforce back-pressure without additional collectors. By reusing existing Telegraf agents already collecting system, application, or SNMP data, organizations can funnel rich telemetry into OpenObserve dashboards and SQL-like analytics with minimal overhead, enabling unified observability, long-term retention, and real-time alerting without vendor lock-in.

Configuration

Kinesis

# Configuration for the AWS Kinesis input.
[[inputs.kinesis_consumer]]
  ## Amazon REGION of kinesis endpoint.
  region = "ap-southeast-2"

  ## Amazon Credentials
  ## Credentials are loaded in the following order
  ## 1) Web identity provider credentials via STS if role_arn and web_identity_token_file are specified
  ## 2) Assumed credentials via STS if role_arn is specified
  ## 3) explicit credentials from 'access_key' and 'secret_key'
  ## 4) shared profile from 'profile'
  ## 5) environment variables
  ## 6) shared credentials file
  ## 7) EC2 Instance Profile
  # access_key = ""
  # secret_key = ""
  # token = ""
  # role_arn = ""
  # web_identity_token_file = ""
  # role_session_name = ""
  # profile = ""
  # shared_credential_file = ""

  ## Endpoint to make request against, the correct endpoint is automatically
  ## determined and this option should only be set if you wish to override the
  ## default.
  ##   ex: endpoint_url = "http://localhost:8000"
  # endpoint_url = ""

  ## Kinesis StreamName must exist prior to starting telegraf.
  streamname = "StreamName"

  ## Shard iterator type (only 'TRIM_HORIZON' and 'LATEST' currently supported)
  # shard_iterator_type = "TRIM_HORIZON"

  ## Max undelivered messages
  ## This plugin uses tracking metrics, which ensure messages are read to
  ## outputs before acknowledging them to the original broker to ensure data
  ## is not lost. This option sets the maximum messages to read from the
  ## broker that have not been written by an output.
  ##
  ## This value needs to be picked with awareness of the agent's
  ## metric_batch_size value as well. Setting max undelivered messages too high
  ## can result in a constant stream of data batches to the output. While
  ## setting it too low may never flush the broker's messages.
  # max_undelivered_messages = 1000

  ## Data format to consume.
  ## Each data format has its own unique set of configuration options, read
  ## more about them here:
  ## https://github.com/influxdata/telegraf/blob/master/docs/DATA_FORMATS_INPUT.md
  data_format = "influx"

  ##
  ## The content encoding of the data from kinesis
  ## If you are processing a cloudwatch logs kinesis stream then set this to "gzip"
  ## as AWS compresses cloudwatch log data before it is sent to kinesis (aws
  ## also base64 encodes the zip byte data before pushing to the stream.  The base64 decoding
  ## is done automatically by the golang sdk, as data is read from kinesis)
  ##
  # content_encoding = "identity"

  ## Optional
  ## Configuration for a dynamodb checkpoint
  [inputs.kinesis_consumer.checkpoint_dynamodb]
    ## unique name for this consumer
    app_name = "default"
    table_name = "default"

OpenObserve

[[outputs.http]]
  ## OpenObserve JSON metrics ingestion endpoint
  url = "https://api.openobserve.ai/api/default/ingest/metrics/_json"

  ## Use POST to push batches
  method = "POST"

  ## Basic auth header (base64 encoded "username:password")
  headers = { Authorization = "Basic dXNlcjpwYXNzd29yZA==" }

  ## Timeout for HTTP requests
  timeout = "10s"

  ## Override Content-Type to match OpenObserve expectation
  content_type = "application/json"

  ## Force Telegraf to batch and serialize metrics as JSON
  data_format = "json"

  ## JSON serializer specific options
  json_timestamp_units = "1ms"

  ## Uncomment to restrict batch size
  # batch_size = 5000

Input and output integration examples

Kinesis

1. Real-Time Data Processing with Kinesis: This use case involves integrating the Kinesis plugin with a monitoring dashboard to analyze incoming data metrics in real-time. For instance, an application could consume logs from multiple services and present them visually, allowing operations teams to quickly identify trends and react to anomalies as they occur.

2. Serverless Log Aggregation: Utilize this plugin in a serverless architecture where Kinesis streams aggregate logs from various microservices. The plugin can create metrics that help detect issues in the system, automating alerting processes through third-party integrations, enabling teams to minimize downtime and improve reliability.

3. Dynamic Scaling Based on Stream Metrics: Implement a solution where stream metrics consumed by the Kinesis plugin could be used to adjust resources dynamically. For example, if the number of records processed spikes, corresponding scale-up actions could be triggered to handle the increased load, ensuring optimal resource allocation and performance.

4. Data Pipeline to S3 with Checkpointing: Create a robust data pipeline where Kinesis stream data is processed through the Telegraf Kinesis plugin, with checkpoints stored in DynamoDB. This approach can ensure data consistency and reliability, as it manages the state of processed data, enabling seamless integration with downstream data lakes or storage solutions.

OpenObserve

1. Edge Device Health Mirror: Deploy Telegraf on thousands of industrial IoT devices to capture temperature, vibration, and power metrics, then use this output to push JSON batches to OpenObserve. Plant operators gain a real-time overview of machine health and can trigger maintenance based on anomalies without relying on heavyweight collectors.

2. Blue-Green Deployment Canary: Attach a lightweight Telegraf sidecar to each Kubernetes release-candidate pod that scrapes /metrics and forwards container stats to a dedicated “canary” stream in OpenObserve. Continuous comparison of error rates between blue and green versions empowers the CI pipeline to auto-roll back poor performers within seconds.

3. Multi-Tenant SaaS Billing Pipeline: Emit per-customer usage counters via Telegraf and tag them with tenant_id; the HTTP plugin posts them to OpenObserve where SQL reports aggregate usage into invoices, eliminating separate metering services and simplifying compliance audits.

4. Security Threat Scoring: Fuse Suricata events and host resource metrics in Telegraf, deliver them to OpenObserve’s analytics engine, and run stream-processing rules that correlate spikes in suspicious traffic with CPU saturation to produce an actionable threat score and automatically open tickets in a SOAR platform.

Feedback

Thank you for being part of our community! If you have any general feedback or found any bugs on these pages, we welcome and encourage your input. Please submit your feedback in the InfluxDB community Slack.