Verify Vault metrics with Telegraf

Introduction

Prerequisites

• Vault
• Telegraf

Overview

Telegraf is often used to direct Vault metrics sent to statsd to platforms such as Splunk to be visualized. It can be usefull to see what Vault is sending before the data reaches it's a final destination, i.e to confirm something has in-fact been sent. 

Procedures

- Add the following to the bottom of your Telegraf config file often found at /etc/telegraf/telegraf.conf ensuring the output destination is updated

[[outputs.file]]
  files = ["stdout", "<LOCATION FOR OUTPUT TO BE WRITTEN>"]
  data_format = "json"
  json_timestamp_units = "1s"

- Restart Telegraf systemctl restart telegraf

- Review the data in the output or specifically search a for a metric, i.e. grep vault.core.unsealed <LOCATION FOR OUTPUT TO BE WRITTEN>

- Clean up by removing the stanza from the Telegraf config, restarting Telegraf again and remove the output file.

Note: If not cleaned up, the output file could potentially fill the disk with where it is being written over time. 

Reference

JSON output data format: https://docs.influxdata.com/telegraf/v1/data_formats/output/json/