Wireguard and Apache Druid Integration

Input and output integration overview

This plugin collects and reports statistics from the local Wireguard server, providing insights into its interfaces and peers.

This plugin allows Telegraf to send JSON-formatted metrics to Apache Druid over HTTP, enabling real-time ingestion for analytical queries on high-volume time-series data.

Integration details

Wireguard

The Wireguard plugin collects statistics on the local Wireguard server using the wgctrl library. It reports gauge metrics for Wireguard interface device(s) and its peers. This enables monitoring of various parameters related to Wireguard functionality, enhancing an administrator’s capability to assess the performance and status of their Wireguard setup. The metrics collected can lead to proactive management of the network interfaces, aiding in detecting and resolving issues before they impact service availability.

Apache Druid

This configuration uses Telegraf’s HTTP output plugin with json data format to send metrics directly to Apache Druid, a real-time analytics database designed for fast, ad hoc queries on high-ingest time-series data. Druid supports ingestion via HTTP POST to various components like the Tranquility service or native ingestion endpoints. The JSON format is ideal for structuring Telegraf metrics into event-style records for Druid’s columnar and time-partitioned storage engine. Druid excels at powering interactive dashboards and exploratory queries across massive datasets, making it an excellent choice for real-time observability and monitoring analytics when integrated with Telegraf.

Configuration

Wireguard

[[inputs.wireguard]]
  ## Optional list of Wireguard device/interface names to query.
  ## If omitted, all Wireguard interfaces are queried.
  # devices = ["wg0"]

Apache Druid

[[outputs.http]]
  ## Druid ingestion endpoint (e.g., Tranquility, HTTP Ingest, or Kafka REST Proxy)
  url = "http://druid-ingest.example.com/v1/post"

  ## Use POST method to send events
  method = "POST"

  ## Data format for Druid ingestion (expects JSON format)
  data_format = "json"

  ## Optional headers (may vary depending on Druid setup)
  # [outputs.http.headers]
  #   Content-Type = "application/json"
  #   Authorization = "Bearer YOUR_API_TOKEN"

  ## Optional timeout and TLS settings
  timeout = "10s"
  # tls_ca = "/path/to/ca.pem"
  # tls_cert = "/path/to/cert.pem"
  # tls_key = "/path/to/key.pem"
  # insecure_skip_verify = false

Input and output integration examples

Wireguard

1. Network Performance Monitoring: Monitor the performance metrics of your Wireguard interfaces, allowing you to track bandwidth usage and identify potential bottlenecks in real-time. By integrating these statistics into your existing monitoring system, network administrators can gain insights into the efficiency of their VPN configuration and make data-driven adjustments.

2. Peer Health Checks: Implement health checks for Wireguard peers by monitoring the last handshake time and traffic metrics. If a peer shows a significant drop in RX/TX bytes or hasn’t completed a handshake in a timely manner, alerts can be triggered to address potential connectivity issues proactively.

3. Dynamic Resource Allocation: Use the metrics collected by the Wireguard plugin to dynamically allocate or adjust network resources based on current bandwidth usage and peer activity. For instance, when a peer is heavily utilized, administrators can respond by allocating additional resources or adjusting configurations to optimize performance accordingly.

4. Historical Data Analysis: Aggregate data over time to analyze historical trends in Wireguard device performance. By storing these metrics in a time-series database, teams can visualize long-term trends, assess the impact of configuration changes, and drive strategic decisions regarding network management.

Apache Druid

1. Real-Time Application Monitoring Dashboard: Use Telegraf to collect metrics from application servers and send them to Druid for immediate analysis and visualization in dashboards. Druid’s low-latency querying allows users to interactively explore system behavior in near real-time.

2. Security Event Aggregation: Aggregate and forward security-related metrics such as failed logins, port scans, or process anomalies to Druid. Analysts can build dashboards to monitor threat patterns and investigate incidents with millisecond-level granularity.

3. IoT Device Analytics: Collect telemetry from edge devices via Telegraf and send it to Druid for fast, scalable processing. Druid’s time-partitioned storage and roll-up capabilities are ideal for handling billions of small JSON events from sensors or gateways.

4. Web Traffic Behavior Exploration: Use Telegraf to capture web server metrics (e.g., requests per second, latency, error rates) and forward them to Druid. This enables teams to drill down into user behavior by region, device, or request type with subsecond query performance.

Feedback

Thank you for being part of our community! If you have any general feedback or found any bugs on these pages, we welcome and encourage your input. Please submit your feedback in the InfluxDB community Slack.