Telegraf

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Telegraf. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Pick an instance type of t3.small or larger. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, and create or select a security group that opens port 22 from your management network. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialization takes a few seconds after the instance state becomes Running and the status checks pass. telegraf.service is already running its sample pipeline by the time you can connect.

The following command launches an instance from the SecureAnyCloud Telegraf Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing. Replace <key-name> with your EC2 key pair name and <subnet-id> with your subnet ID. Replace <security-group-id> with a security group that opens port 22 from your management network.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type t3.small \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=telegraf}]'

When the instance reaches the Running state and its status checks pass, note its public IP address or DNS name. You can find it in the EC2 console or with aws ec2 describe-instances.

Connect over SSH using your key pair. The login user on the Ubuntu 24.04 variant is ubuntu:

ssh -i <key-name>.pem ubuntu@<public-ip>

A welcome banner prints the most useful commands. Run sudo cat /root/telegraf-info.txt to see the full getting-started notes. They cover what is running, the Prometheus endpoint, where the pipeline configuration lives, the file output path, the common input, processor and output plugins, and how to validate and reload the configuration.

Telegraf runs as a system service that is enabled and started on boot. Confirm that the daemon is active:

systemctl is-active telegraf

The command prints active. To see the full unit status, including the main PID, memory use and the command line the daemon is running, run:

systemctl status telegraf --no-pager

Confirm the installed binary and the Telegraf version, which is pinned to 1.39.0 on this image:

telegraf --version

The output reports Telegraf 1.39.0. The telegraf binary is on the system path at /usr/bin/telegraf. The package installs the telegraf.service systemd unit, which runs the agent as the dedicated telegraf user.

Telegraf ships with a built-in Prometheus client output. On this image it is enabled and bound to loopback only (127.0.0.1:9273), so the metrics endpoint answers on the instance but is never exposed to the network. The endpoint serves a standard Prometheus exposition page with the live host metrics that the sample input plugins collect. Query it:

curl -s http://127.0.0.1:9273/metrics | grep -E "^(cpu_usage_idle|mem_used_percent|system_uptime)" | head

The output shows the cpu_usage_idle, mem_used_percent and system_uptime measurements with their current values, each tagged with the host. This confirms that the input plugins are collecting host telemetry and that the output is serving it, not merely loaded. To list the metric families that the agent exposes, run:

curl -s http://127.0.0.1:9273/metrics | grep "^# TYPE" | head -20

To scrape Telegraf from a Prometheus server, change the listen address in the outputs.prometheus_client block of the configuration to a routable interface, and open port 9273 in the instance security group yourself. The read-only endpoint stays private by default.

Telegraf reads its pipeline from a simple TOML configuration file at /etc/telegraf/telegraf.conf, with optional drop-in snippets under /etc/telegraf/telegraf.d/. The shipped configuration is a self-contained sample that needs no external dependencies. List the configuration directory:

ls /etc/telegraf/

The shipped sample pairs the cpu, mem, disk and system input plugins (real host telemetry on a 10-second interval) with the prometheus_client output (the loopback metrics endpoint) and a file output that persists the metrics as line protocol on the data volume. Read the input and output blocks:

grep -vE "^\s*#|^\s*$" /etc/telegraf/telegraf.conf

To build your own pipeline, enable the plugins you need. Common input plugins collect data from your sources: cpu, mem, disk, net and system for the host, docker for containers, postgresql, mysql and redis for databases, kafka for queues, and snmp, prometheus, statsd, http and exec for protocols and custom sources. Chain processor and aggregator plugins (converter, regex, enum, basicstats, histogram) to transform, enrich and roll up the stream. Send the stream to output plugins to ship the metrics: influxdb/influxdb_v2, prometheus_client, graphite, kafka, cloudwatch, opentsdb, http and file. The single static binary bundles the entire plugin set, so most sources and destinations need only a configuration block and no extra installs.

After you edit the configuration, validate it, then restart the service to apply your changes. These commands test and reload your pipeline:

sudo telegraf --config /etc/telegraf/telegraf.conf --test sudo systemctl restart telegraf

The --test run loads the configuration, runs one collection cycle, prints the metrics it gathered, and exits without starting the daemon. It is a quick way to confirm that a new input works. Open whatever scrape or forward ports your pipeline needs in the instance security group.

The sample file output writes to a dedicated EBS volume mounted at /var/lib/telegraf. This keeps the persisted metrics off the operating system disk and lets you resize or snapshot the volume independently. Confirm the mount and watch the metrics flow:

df -h /var/lib/telegraf
sudo tail -n 4 /var/lib/telegraf/telegraf-metrics.out

The sample output appends the collected metrics as InfluxDB line protocol to /var/lib/telegraf/telegraf-metrics.out, one line per measurement per collection cycle. To grow the volume, expand the EBS volume in the AWS console, then grow the file system on the instance by running sudo resize2fs on the underlying device. Point your own file or buffered outputs at this volume to give them the same durable, independently resizable storage.