Netdata Agent Extractor

Point at any open Netdata monitoring agent and export its node info, metric catalog, active alarms, or fleet inventory as a clean dataset — straight from the public, unauthenticated Netdata REST API.

Netdata is the dominant real-time, self-hosted infrastructure-monitoring agent (~74k★). It ships open-by-default without auth — its threat model assumes the API port is unreachable from the internet — so every exposed Agent serves the identical REST API. This one actor therefore spans every Netdata agent in existence: no per-host scraper, no host enumeration, no API key.

Modes

Set mode to pick what to extract:

Input

{
  "sources": ["https://netdata.firehol.org"],
  "mode": "info",
  "chartFilter": "",
  "maxRecords": 100
}

• sources (required) — a list of Netdata base URLs (or full …/api/v1/info URLs). Point at one node or a whole list.
• mode — info (default) · charts · alarms · nodes.
• chartFilter — optional case-insensitive substring on a chart's id and context (charts mode only). e.g. disk matches disk.io, app.disk_logical_io, …
• maxRecords — optional global cap on emitted rows (each row is one billable event).
• bearer / extraHeaders — optional auth for a gated agent. Never required for public agents, never logged.

Output

One flat, fully-typed row per record. Columns are shared across all modes (unused columns are null), plus a lossless _raw object with the untouched source record and _source / _mode / _apiVersion provenance. Example (info mode):

{
  "_mode": "info",
  "hostname": "iplists.firehol.org",
  "version": "v2.10.0-643-nightly",
  "osName": "Debian GNU/Linux",
  "kernel": "6.1.0-49-amd64",
  "architecture": "x86_64",
  "virtualization": "kvm",
  "coresTotal": 2,
  "ramTotal": 4105359360,
  "chartsCount": 1773,
  "alarmsNormal": 156,
  "alarmsWarning": 0,
  "alarmsCritical": 0,
  "mirroredHosts": ["iplists.firehol.org"],
  "_source": "https://netdata.firehol.org/api/v1/info"
}

Robustness

• The parse is the moat. The /api/v1/info schema is nightly-versioned and drifts across releases, so every field is read by key presence — a node omitting container / cpu_freq / mirrored_hosts yields null, never a crash. Netdata's string-encoded numerics ("cores_total": "2") are coerced to integers; the nested alarms object is promoted to three integer columns.
• Per-source resilience. In a multi-source run, a host that is auth-gated (401/403), unreachable (Cloudflare 52x), timing out, or Cloud-only is skipped with a warning and the run continues — one bad host never fails the batch.
• Honest failure. A source that answers with a body that is not a Netdata API shape (an HTML error page, a wrong-shaped JSON object) is a clear fail-fast, so a misconfigured input never silently returns nothing.

Pricing

Pay-per-event: $0.0005 per record (one emitted dataset row = one event).

Scope

Netdata REST API only (/api/v1/info, /api/v1/charts, /api/v1/alarms, /api/v3/info). Metric time-series data (/api/v1/data) and Netdata Cloud (cloud-only nodes with no exposed Agent port) are out of scope.