Repository: influxdata/telegraf (2026-04-09T16:25:25Z)

Issue:
Telegraf nftables plugin - unmarshall error in set
### Relevant telegraf.conf

```toml
[[inputs.nftables]]
  ## Use the specified binary which will be looked-up in PATH
  binary = "/usr/sbin/nft"

  ## Use sudo for command execution, can be restricted to
  ## "nft --json list table"
  use_sudo = true

  ## Tables to monitor (may use "family table" format, e.g., "inet filter")
  tables = [ "inet firewall" ]

  ## Kinds of objects to monitor: "counters" (named counters), "sets",
  ## (named sets), "anonymous-counters" (on commented rules).
  include = ["counters" , "sets"]
```

### Logs from Telegraf

```text
2026-04-09T15:53:10Z W! Strict environment variable handling is the new default starting with v1.38.0! If your configuration does not work with strict handling please explicitly add the --non-strict-env-handling flag to switch to the previous behavior!
2026-04-09T15:53:10Z I! Loading config: telegraf.conf
2026-04-09T15:53:10Z I! Starting Telegraf 1.39.0-7fd2a36d (customized) brought to you by InfluxData the makers of InfluxDB
2026-04-09T15:53:10Z I! Available plugins: 7 inputs, 0 aggregators, 0 processors, 4 parsers, 1 outputs, 0 secret-stores
2026-04-09T15:53:10Z I! Loaded inputs: cpu nftables
2026-04-09T15:53:10Z I! Loaded aggregators:
2026-04-09T15:53:10Z I! Loaded processors:
2026-04-09T15:53:10Z I! Loaded secretstores:
2026-04-09T15:53:10Z W! Outputs are not used in testing mode!
2026-04-09T15:53:10Z I! Tags enabled: host=virtualserver
2026-04-09T15:53:10Z D! [agent] Initializing plugins
2026-04-09T15:53:10Z D! [agent] Starting service inputs
2026-04-09T15:53:10Z E! [inputs.nftables] Error in plugin: parsing command output failed: unable to parse set: json: cannot unmarshal string into Go struct field namedSet.elem of type nftables.elem
```

### System info

Telegraf 1.39.0-7fd2a36d (customized)

### Docker

_No response_

### Steps to reproduce

I have this set defined in my nftables.conf:

set AllowedIPs {
  type ipv4_addr
  elements = { 10.47.55.250, 10.47.56.232 }
}
the nft --json list table firewall output:
    {
      "set": {
        "family": "inet",
        "name": "AllowedIPs",
        "table": "firewall",
        "type": "ipv4_addr",
        "handle": 18,
        "flags": [
          "interval"
        ],
        "elem": [
          "10.47.55.250",
          "10.47.56.232"
        ]
      }
    }

This issue looks to be because it’s expecting the element to be more like

"elem": [{ "val": "10.47.55.250" }]

Looks like (with my basic understanding) this has to do with how elem is defined in types.go
type namedSet struct {
	Family string `json:"family"`
	Name   string `json:"name"`
	Table  string `json:"table"`
	Elem   []elem `json:"elem,omitempty"`
}

type elem struct{}



### Expected behavior

If the set is updated dynamically it does return objects in elem, however, predefined sets do not return an object but rather a list of strings, which causes the unmarshal to fail. Since the plugin is only counting the entries in elem perhaps it could be adjusted to work with either objects or strings.

### Actual behavior

Get the error above

### Additional info

Was directed to create a bug report: https://community.influxdata.com/t/telegraf-nftables-plugin-unmarshall-error-in-set/58409


Discussion:
Wow that was fast, I copied the additional lines of code and rebuilt telegraf and sure enough it works!  Appreciate the quick response.



Patch:
diff --git a/plugins/inputs/nftables/types.go b/plugins/inputs/nftables/types.go
index d8a2a5d4338f3..f86996b4e31ed 100644
--- a/plugins/inputs/nftables/types.go
+++ b/plugins/inputs/nftables/types.go
@@ -110,3 +110,10 @@ type namedSet struct {
 }
 
 type elem struct{}
+
+// UnmarshalJSON accepts any JSON value type. Statically defined nftables sets
+// use plain strings for elements while dynamically added entries use objects.
+// Since the plugin only counts elements, the content is discarded.
+func (*elem) UnmarshalJSON([]byte) error {
+	return nil
+}


Test patch:
diff --git a/plugins/inputs/nftables/testcases/valid/expected.out b/plugins/inputs/nftables/testcases/valid/expected.out
index d145cb9389aa9..942c03b22eafa 100644
--- a/plugins/inputs/nftables/testcases/valid/expected.out
+++ b/plugins/inputs/nftables/testcases/valid/expected.out
@@ -1,4 +1,5 @@
 nftables,chain=test-chain,rule=test1,table=test bytes=2i,pkts=1i 1763040447356073265
 nftables,chain=test-chain,rule=test2,table=test bytes=1412296i,pkts=24468i 1763040447356078375
 nftables,set=non_empty_set,table=test count=5i 1763040447356078375
+nftables,set=static_set,table=test count=2i 1763040447356078375
 nftables,set=empty_set,table=test count=0i 1763040447356078375
diff --git a/plugins/inputs/nftables/testcases/valid/table_test.json b/plugins/inputs/nftables/testcases/valid/table_test.json
index cf917bc8605f8..14014b9b3288b 100644
--- a/plugins/inputs/nftables/testcases/valid/table_test.json
+++ b/plugins/inputs/nftables/testcases/valid/table_test.json
@@ -185,6 +185,20 @@
         ]
       }
     },
+    {
+      "set": {
+        "family": "inet",
+        "name": "static_set",
+        "table": "test",
+        "type": "ipv4_addr",
+        "handle": 18,
+        "flags": ["interval"],
+        "elem": [
+          "10.47.55.250",
+          "10.47.56.232"
+        ]
+      }
+    },
     {
       "set": {
         "family": "inet",