ntpq and OpenSearch Integration

Input and output integration overview

The ntpq plugin collects standard metrics related to the Network Time Protocol (NTP) by executing the ntpq command. It gathers essential information about the synchronization state of the local machine with remote NTP servers, providing valuable insights into timekeeping accuracy and network performance.

The OpenSearch Output Plugin allows users to send metrics directly to an OpenSearch instance using HTTP, thus facilitating effective data management and analytics within the OpenSearch ecosystem.

Integration details

ntpq

The ntpq Telegraf plugin provides a way to gather metrics from the Network Time Protocol (NTP) by querying the NTP server using the ntpq executable. This plugin collects a variety of metrics related to the synchronization status with remote NTP servers, including delay, jitter, offset, polling frequency, and reachability. These metrics are crucial for understanding the performance and reliability of time synchronization efforts in systems that rely on accurate timekeeping. NTP plays a vital role in networked environments, enabling synchronized clocks across devices which is essential for logging, coordination of activities, and security protocols. Through this plugin, users can monitor the effectiveness of their time synchronization processes, making it easier to identify issues related to network delays or misconfigurations, thus ensuring that systems remain in sync and operate efficiently.

OpenSearch

The OpenSearch Telegraf Plugin integrates with the OpenSearch database via HTTP, allowing for the streamlined collection and storage of metrics. As a powerful tool designed specifically for OpenSearch releases from 2.x, the plugin provides robust features while offering compatibility with 1.x through the original Elasticsearch plugin. This plugin facilitates the creation and management of indexes in OpenSearch, automatically managing templates and ensuring that data is structured efficiently for analysis. The plugin supports various configuration options such as index names, authentication, health checks, and value handling, allowing it to be tailored to diverse operational requirements. Its capabilities make it essential for organizations looking to harness the power of OpenSearch for metrics storage and querying.

Configuration

ntpq

[[inputs.ntpq]]
  ## Servers to query with ntpq.
  ## If no server is given, the local machine is queried.
  # servers = []

  ## If false, set the -n ntpq flag. Can reduce metric gather time.
  ## DEPRECATED since 1.24.0: add '-n' to 'options' instead to skip DNS lookup
  # dns_lookup = true

  ## Options to pass to the ntpq command.
  # options = "-p"

  ## Output format for the 'reach' field.
  ## Available values are
  ##   octal   --  output as is in octal representation e.g. 377 (default)
  ##   decimal --  convert value to decimal representation e.g. 371 -> 249
  ##   count   --  count the number of bits in the value. This represents
  ##               the number of successful reaches, e.g. 37 -> 5
  ##   ratio   --  output the ratio of successful attempts e.g. 37 -> 5/8 = 0.625
  # reach_format = "octal"

OpenSearch

[[outputs.opensearch]]
  ## URLs
  ## The full HTTP endpoint URL for your OpenSearch instance. Multiple URLs can
  ## be specified as part of the same cluster, but only one URLs is used to
  ## write during each interval.
  urls = ["http://node1.os.example.com:9200"]

  ## Index Name
  ## Target index name for metrics (OpenSearch will create if it not exists).
  ## This is a Golang template (see https://pkg.go.dev/text/template)
  ## You can also specify
  ## metric name (`{{.Name}}`), tag value (`{{.Tag "tag_name"}}`), field value (`{{.Field "field_name"}}`)
  ## If the tag does not exist, the default tag value will be empty string "".
  ## the timestamp (`{{.Time.Format "xxxxxxxxx"}}`).
  ## For example: "telegraf-{{.Time.Format \"2006-01-02\"}}-{{.Tag \"host\"}}" would set it to telegraf-2023-07-27-HostName
  index_name = ""

  ## Timeout
  ## OpenSearch client timeout
  # timeout = "5s"

  ## Sniffer
  ## Set to true to ask OpenSearch a list of all cluster nodes,
  ## thus it is not necessary to list all nodes in the urls config option
  # enable_sniffer = false

  ## GZIP Compression
  ## Set to true to enable gzip compression
  # enable_gzip = false

  ## Health Check Interval
  ## Set the interval to check if the OpenSearch nodes are available
  ## Setting to "0s" will disable the health check (not recommended in production)
  # health_check_interval = "10s"

  ## Set the timeout for periodic health checks.
  # health_check_timeout = "1s"
  ## HTTP basic authentication details.
  # username = ""
  # password = ""
  ## HTTP bearer token authentication details
  # auth_bearer_token = ""

  ## Optional TLS Config
  ## Set to true/false to enforce TLS being enabled/disabled. If not set,
  ## enable TLS only if any of the other options are specified.
  # tls_enable =
  ## Trusted root certificates for server
  # tls_ca = "/path/to/cafile"
  ## Used for TLS client certificate authentication
  # tls_cert = "/path/to/certfile"
  ## Used for TLS client certificate authentication
  # tls_key = "/path/to/keyfile"
  ## Send the specified TLS server name via SNI
  # tls_server_name = "kubernetes.example.com"
  ## Use TLS but skip chain & host verification
  # insecure_skip_verify = false

  ## Template Config
  ## Manage templates
  ## Set to true if you want telegraf to manage its index template.
  ## If enabled it will create a recommended index template for telegraf indexes
  # manage_template = true

  ## Template Name
  ## The template name used for telegraf indexes
  # template_name = "telegraf"

  ## Overwrite Templates
  ## Set to true if you want telegraf to overwrite an existing template
  # overwrite_template = false

  ## Document ID
  ## If set to true a unique ID hash will be sent as
  ## sha256(concat(timestamp,measurement,series-hash)) string. It will enable
  ## data resend and update metric points avoiding duplicated metrics with
  ## different id's
  # force_document_id = false

  ## Value Handling
  ## Specifies the handling of NaN and Inf values.
  ## This option can have the following values:
  ##    none    -- do not modify field-values (default); will produce an error
  ##               if NaNs or infs are encountered
  ##    drop    -- drop fields containing NaNs or infs
  ##    replace -- replace with the value in "float_replacement_value" (default: 0.0)
  ##               NaNs and inf will be replaced with the given number, -inf with the negative of that number
  # float_handling = "none"
  # float_replacement_value = 0.0

  ## Pipeline Config
  ## To use a ingest pipeline, set this to the name of the pipeline you want to use.
  # use_pipeline = "my_pipeline"

  ## Pipeline Name
  ## Additionally, you can specify a tag name using the notation (`{{.Tag "tag_name"}}`)
  ## which will be used as the pipeline name (e.g. "{{.Tag \"os_pipeline\"}}").
  ## If the tag does not exist, the default pipeline will be used as the pipeline.
  ## If no default pipeline is set, no pipeline is used for the metric.
  # default_pipeline = ""

Input and output integration examples

ntpq

1. Network Time Monitoring Dashboard: Utilize the ntpq plugin to create a centralized monitoring dashboard for tracking the reliability and performance of network time synchronization across multiple servers. By visualizing metrics such as delay and jitter, system administrators can quickly identify which servers are providing accurate time versus those with significant latency issues, ensuring that all systems remain synchronized effectively.

2. Automated Alert System for Time Drift: Implement an automated alert system that leverages ntpq metrics to notify operations teams when time drift exceeds acceptable thresholds. By analyzing the offset and jitter values, the system can trigger alerts if any remote NTP server is out of sync, allowing for swift remediation actions to maintain time accuracy across critical infrastructure.

3. Comparative Analysis of Time Sources: Use the ntpq plugin to perform a comparative analysis of different NTP servers over time. By querying multiple NTP sources and monitoring their metrics, organizations can evaluate the performance and reliability of their time sources, making informed decisions about which NTP servers to configure as primary or secondary in their environments.

4. Historical Performance Tracking for NTP: Gather historical performance data on various NTP servers using the ntpq plugin, enabling long-term trend analysis for timekeeping accuracy. This can help organizations identify patterns or recurring issues related to specific servers, informing future decisions about infrastructure changes or adjustments related to time synchronization strategies.

OpenSearch

1. Dynamic Indexing for Time-Series Data: Utilize the OpenSearch Telegraf plugin to dynamically create indexes for time-series metrics, ensuring that data is stored in an organized manner conducive to time-based queries. By defining index patterns using Go templates, users can leverage the plugin to create daily or monthly indexes, which can greatly simplify data management and retrieval over time, thus enhancing analytical performance.

2. Centralized Logging for Multi-Tenant Applications: Implement the OpenSearch plugin in a multi-tenant application where each tenant’s logs are sent to separate indexes. This enables targeted analysis and monitoring for each tenant while maintaining data isolation. By utilizing the index name templating feature, users can automatically create tenant-specific indexes, which not only streamlines the process but also enhances security and accessibility for tenant data.

3. Integration with Machine Learning for Anomaly Detection: Leverage the OpenSearch plugin alongside machine learning tools to automatically detect anomalies in metrics data. By configuring the plugin to send real-time metrics to OpenSearch, users can apply machine learning models on the incoming data streams to identify outliers or unusual patterns, facilitating proactive monitoring and swift remedial actions.

4. Enhanced Monitoring Dashboards with OpenSearch: Use the metrics collected from OpenSearch to create real-time dashboards that provide insights into system performance. By feeding metrics into OpenSearch, organizations can utilize OpenSearch Dashboards to visualize key performance indicators, allowing operations teams to quickly assess health and performance, and making data-driven decisions.

Feedback

Thank you for being part of our community! If you have any general feedback or found any bugs on these pages, we welcome and encourage your input. Please submit your feedback in the InfluxDB community Slack.