Error parsing geoip, undefined but requested processor: geoip

[roberto103]

I'm trying to use the Plugin in Telgraf v1.28.3 in Docker.

I built the GeoIP binary and copied it to the container's /etc/telegraf/telegraf.d folder, along with the geoip.conf and GeoLite2-City.mmdb files, but when I start the container it does not recognize the geoip processor.

geoip.conf:

[[processors.geoip]]
  db_path = "/etc/telegraf/telegraf.d/GeoLite2-City.mmdb"

[[processors.geoip.lookup]]
  field = "src"
  dest_country = "source_country"
  dest_city = "source_city"
  dest_lat = "source_lat"
  dest_lon = "source_lon"

Container log:

2023-11-11T18:24:38Z I! Loading config: /etc/telegraf/telegraf.conf
2023-11-11T18:24:38Z I! Loading config: /etc/telegraf/telegraf.d/geoip.conf
2023-11-11T18:24:38Z I! Starting Telegraf 1.28.3 brought to you by InfluxData the makers of InfluxDB
2023-11-11T18:24:38Z I! Available plugins: 240 inputs, 9 aggregators, 29 processors, 24 parsers, 59 outputs, 5 secret-stores
2023-11-11T18:24:38Z I! Loaded inputs: netflow
2023-11-11T18:24:38Z I! Loaded aggregators:
2023-11-11T18:24:38Z I! Loaded processors:
2023-11-11T18:24:38Z I! Loaded secretstores:
2023-11-11T18:24:38Z I! Loaded outputs: influxdb_v2
2023-11-11T18:24:38Z I! Tags enabled: host=bad7027e7664
2023-11-11T18:24:38Z I! [agent] Config: Interval:1m0s, Quiet:false, Hostname:"bad7027e7664", Flush Interval:10s
2023-11-11T18:24:38Z I! [inputs.netflow] Loaded 0 PEN mappings...
2023-11-11T18:24:38Z I! [inputs.netflow] Listening on udp://[::]:2055
2023-11-11T18:24:44Z I! [agent] Hang on, flushing any cached metrics before shutdown
2023-11-11T18:24:44Z I! [agent] Stopping running outputs
2023-11-11T18:25:13Z I! Loading config: /etc/telegraf/telegraf.conf
2023-11-11T18:25:13Z I! Loading config: /etc/telegraf/telegraf.d/geoip.conf
2023-11-11T18:25:13Z E! error loading config file /etc/telegraf/telegraf.d/geoip.conf: error parsing geoip, undefined but requested processor: geoip

Files in telegraf.d:

[a-bali]

Do you run the plugin as described in the README?

[[processors.execd]] command = ["/path/to/geoip_binary", "--config", "/path/to/geoip_config_file"]

[roberto103]

Yes, this is my telegraf.conf:

[global_tags]

[agent]
  interval = "60s"
  round_interval = true
  metric_batch_size = 1000
  metric_buffer_limit = 10000
  collection_jitter = "0s"
  flush_interval = "10s"
  flush_jitter = "0s"
  precision = ""
  hostname = "telegraf"
  omit_hostname = false

[[outputs.influxdb_v2]]
  urls = ["http://influxdb:8086"]
  token = "XXXXXXXXXXXXXX"
  organization = "myorg"
  bucket = "netflow"

[[inputs.netflow]]
  service_address = "udp://:2055"
  # read_buffer_size = ""

  ## Protocol version to use for decoding.
  ## Available options are
  ##   "ipfix"      -- IPFIX / Netflow v10 protocol (also works for Netflow v9)
  ##   "netflow v5" -- Netflow v5 protocol
  ##   "netflow v9" -- Netflow v9 protocol (also works for IPFIX)
  ##   "sflow v5"   -- sFlow v5 protocol
  protocol = "netflow v9"

[[processors.execd]]
  command = ["/etc/telegraf/telegraf.d/geoip", "--config", "/etc/telegraf/telegraf.d/geoip.conf"]

[a-bali]

Can you try moving the config for the geoip plugin to a file which is not in the /etc/telegraf/telegraf.d directory? I suspect telegraf itself is sourcing the files in that directory, while this file is supposed to be sourced by the plugin only.

[roberto103]

I changed the files to /opt/telegraf and this is the error I'm getting now

2023-11-13T20:48:05Z I! [processors.execd] Starting process: /opt/telegraf/geoip [--config /opt/telegraf/geoip.conf]
2023-11-13T20:48:06Z E! [telegraf] Error running agent: starting processor processors.execd: failed to start process [/opt/telegraf/geoip --config /opt/telegraf/geoip.conf]: error starting process: fork/exec /opt/telegraf/geoip: exec format error

[a-bali]

Ok, so the previous issue is solved, telegraf now tries to run the plugin.

The exec format error message means that the geoip plugin binary is not compiled for the architecture your docker image is using, e.g. you might have compiled on an x86 host for x86 architecture, but you might be running docker on ARM?

[a-bali]

Closing due to inactivity.