Documentation

CEL functions and operators

Telegraf Controller is in Public Beta

Telegraf Controller is in public beta and will be part of the future Telegraf Enterprise offering. While in beta, Telegraf Controller is not meant for production use. The Telegraf Controller documentation is a work in progress, and we are actively working to improve it. If you have any questions or suggestions, please submit an issue. We welcome any and all contributions.

Beta expectations

Provide beta feedback

CEL expressions for agent status evaluation support built-in CEL operators and the following function libraries.

Time functions

now()

Returns the current time. Use with last_update to calculate durations or detect stale data.

// True if more than 10 minutes since last heartbeat
now() - last_update > duration('10m')
// True if more than 5 minutes since last heartbeat
now() - last_update > duration('5m')

Math functions

Math functions from the CEL math library are available for numeric calculations.

Commonly used functions

FunctionDescriptionExample
math.greatest(a, b, ...)Returns the greatest value.math.greatest(log_errors, log_warnings)
math.least(a, b, ...)Returns the least value.math.least(agent.metrics_gathered, 1000)

Example

// Warn if either errors or warnings exceed a threshold
math.greatest(log_errors, log_warnings) > 5

String functions

String functions from the CEL strings library are available for string operations. These are useful when checking plugin alias or id fields.

Example

// Check if any input plugin has an alias containing "critical"
inputs.cpu.exists(i, has(i.alias) && i.alias.contains("critical"))

Encoding functions

Encoding functions from the CEL encoder library are available for encoding and decoding values.

Operators

CEL supports standard operators for building expressions.

Comparison operators

OperatorDescriptionExample
==Equalmetrics == 0
!=Not equallog_errors != 0
<Less thanagent.metrics_gathered < 100
<=Less than or equalbuffer_fullness <= 0.5
>Greater thanlog_errors > 10
>=Greater than or equalmetrics >= 1000

Logical operators

OperatorDescriptionExample
&&Logical ANDlog_errors > 0 && metrics == 0
||Logical ORlog_errors > 10 || log_warnings > 50
!Logical NOT!(metrics > 0)

Arithmetic operators

OperatorDescriptionExample
+Additionlog_errors + log_warnings
-Subtractionagent.metrics_gathered - agent.metrics_dropped
*Multiplicationlog_errors * 2
/Divisionagent.metrics_dropped / agent.metrics_gathered
%Modulometrics % 100

Ternary operator

// Conditional expression
log_errors > 10 ? true : false

List operations

FunctionDescriptionExample
exists(var, condition)True if any element matches.inputs.cpu.exists(i, i.errors > 0)
all(var, condition)True if all elements match.outputs.influxdb_v2.all(o, o.errors == 0)
size()Number of elements.inputs.cpu.size() > 0
has()True if a field or key exists.has(inputs.cpu)

Was this page helpful?

Thank you for your feedback!


Telegraf Enterprise now in public beta

Get early access to the Telegraf Controller and provide feedback to help shape the future of Telegraf Enterprise.

See the Blog Post

The upcoming Telegraf Enterprise offering is for organizations running Telegraf at scale and is comprised of two key components:

  • Telegraf Controller: A control plane (UI + API) that centralizes Telegraf configuration management and agent health visibility.
  • Telegraf Enterprise Support: Official support for Telegraf Controller and Telegraf plugins.

Join the Telegraf Enterprise beta to get early access to the Telegraf Controller and provide feedback to help shape the future of Telegraf Enterprise.

For more information:

New in InfluxDB 3.8

Key enhancements in InfluxDB 3.8 and the InfluxDB 3 Explorer 1.6.

See the Blog Post

InfluxDB 3.8 is now available for both Core and Enterprise, alongside the 1.6 release of the InfluxDB 3 Explorer UI. This release is focused on operational maturity and making InfluxDB easier to deploy, manage, and run reliably in production.

For more information, check out:

InfluxDB Docker latest tag changing to InfluxDB 3 Core

On May 27, 2026, the latest tag for InfluxDB Docker images will point to InfluxDB 3 Core. To avoid unexpected upgrades, use specific version tags in your Docker deployments.

If using Docker to install and run InfluxDB, the latest tag will point to InfluxDB 3 Core. To avoid unexpected upgrades, use specific version tags in your Docker deployments. For example, if using Docker to run InfluxDB v2, replace the latest version tag with a specific version tag in your Docker pull command–for example:

docker pull influxdb:2