Hashicorp Vault and SigNoz Integration

Input and output integration overview

The Hashicorp Vault plugin for Telegraf allows for the collection of metrics from Hashicorp Vault services, facilitating monitoring and operational insights.

This configuration turns any Telegraf agent into a Remote Write publisher for SigNoz, streaming rich metrics straight into the SigNoz backend with a single URL change.

Integration details

Hashicorp Vault

The Hashicorp Vault plugin is designed to collect metrics from Vault agents running within a cluster. It enables Telegraf, an agent for collecting and reporting metrics, to interface with the Vault services, typically listening on a local address such as http://127.0.0.1:8200. This plugin requires a valid token for authorization, ensuring secure access to the Vault API. Users must configure either a token directly or provide a path to a token file, enhancing flexibility in authentication methods. Proper configuration of the timeout and optional TLS settings further relates to the security and responsiveness of the metrics collection process. As Vault is a critical tool in managing secrets and protecting sensitive data, monitoring its performance and health through this plugin is essential for maintaining operational security and efficiency.

SigNoz

SigNoz is an open source observability platform that stores metrics, traces, and logs. When you deploy SigNoz, its signoz-otel-collector-metrics service exposes a Prometheus Remote Write receiver (default :13133/api/v1/write). By configuring Telegraf’s Prometheus plugin to point at this endpoint, you can push any Telegraf collected metrics, SNMP counters, cloud services, or business KPIs—directly into SigNoz. The plugin natively serializes metrics in the Remote Write protobuf format, supports external labels, metadata export, retries, and TLS or bearer-token auth, so it fits zero-trust and multi-tenant SigNoz clusters. Inside SigNoz, the data lands in ClickHouse tables that back Metrics Explorer, alert rules, and unified dashboards. This approach lets organizations unify Prometheus and OTLP pipelines, enables long-term retention powered by ClickHouse compression, and avoids vendor lock-in while retaining PromQL-style queries.

Configuration

Hashicorp Vault

[[inputs.vault]]
  ## URL for the Vault agent
  # url = "http://127.0.0.1:8200"

  ## Use Vault token for authorization.
  ## Vault token configuration is mandatory.
  ## If both are empty or both are set, an error is thrown.
  # token_file = "/path/to/auth/token"
  ## OR
  token = "s.CDDrgg5zPv5ssI0Z2P4qxJj2"

  ## Set response_timeout (default 5 seconds)
  # response_timeout = "5s"

  ## Optional TLS Config
  # tls_ca = /path/to/cafile
  # tls_cert = /path/to/certfile
  # tls_key = /path/to/keyfile

SigNoz

[[outputs.prometheusremotewrite]]
  ## SigNoz OTEL-Collector metrics endpoint (Prometheus Remote Write receiver)
  ## Default port is 13133 when you install SigNoz with the Helm chart
  url = "http://signoz-otel-collector-metrics.monitoring.svc.cluster.local:13133/api/v1/write"

  ## Add identifying labels so you can slice & dice the data later
  external_labels = { host = "${HOSTNAME}", agent = "telegraf" }

  ## Forward host metadata for richer dashboards (SigNoz maps these to ClickHouse columns)
  send_metadata = true

  ## ----- Authentication (comment out what you don’t need) -----
  # bearer_token   = "$SIGNOZ_TOKEN"          # SaaS tenant token
  # basic_username = "signoz"                 # Basic auth (self-hosted)
  # basic_password = "secret"

  ## ----- TLS options (for SaaS or HTTPS self-hosted) -----
  # tls_ca                  = "/etc/ssl/certs/ca.crt"
  # tls_cert                = "/etc/telegraf/certs/telegraf.crt"
  # tls_key                 = "/etc/telegraf/certs/telegraf.key"
  # insecure_skip_verify    = false

  ## ----- Performance tuning -----
  max_batch_size = 10000      # samples per POST
  timeout        = "10s"
  retry_max      = 3

Input and output integration examples

Hashicorp Vault

1. Centralized Secret Management Monitoring: Utilize the Vault plugin to monitor multiple Vault instances across a distributed system, allowing for a unified view of secret access patterns and system health. This setup can help DevOps teams quickly identify any anomalies in secret access, providing essential insights into security postures across different environments.

2. Audit Logging Integration: Configure this plugin to feed monitoring metrics into an audit logging system, enabling organizations to have a comprehensive view of their Vault interactions. By correlating audit logs with metrics, teams can investigate issues, optimize performance, and ensure compliance with security policies more effectively.

3. Performance Benchmarking During Deployments: During application deployments that interact with Vault, use the plugin to monitor the effects of those deployments on Vault performance. This allows engineering teams to understand how changes impact secret management workflows and to proactively address performance bottlenecks, ensuring smooth deployment processes.

4. Alerting for Threshold Exceedance: Integrate this plugin with alerting mechanisms to notify administrators when metrics exceed predefined thresholds. This proactive monitoring can help teams respond swiftly to potential issues, maintaining system reliability and uptime by allowing them to take action before any serious incidents arise.

SigNoz

1. Multi-Cluster Federated Monitoring: Drop a Telegraf DaemonSet into each Kubernetes cluster, tag metrics with cluster=<name>, and Remote Write them to a central SigNoz instance. Ops teams get a single PromQL window across prod, staging, and edge clusters without running Thanos sidecars.

2. Factory-Floor Edge Gateway: A rugged Intel NUC on the shop floor runs Telegraf to scrape Modbus PLCs and environmental sensors. It batches readings every 5 seconds and pushes them over an intermittent 4G link to SigNoz SaaS. ClickHouse compression keeps costs low while AI-based outlier detection in SigNoz flags overheating motors before failure.

3. SaaS Usage Metering: Telegraf runs alongside each micro-service, exporting per-tenant counters (api_calls, gigabytes_processed). Remote Write streams the data to SigNoz where a scheduled ClickHouse materialized view aggregates usage for monthly billing—no separate metering stack required.

4. Autoscaling Feedback Loop: Combine Telegraf’s Kubernetes input with the Remote Write output to publish granular pod CPU and queue-length metrics into SigNoz. A custom SigNoz alert fires when P95 latency breaches 200 ms and a GitOps controller reads that alert to trigger a HorizontalPodAutoscaler tweak—closing the loop between observability and automation.

Feedback

Thank you for being part of our community! If you have any general feedback or found any bugs on these pages, we welcome and encourage your input. Please submit your feedback in the InfluxDB community Slack.