🚨 Telegraf Error Guide: 'outputs.influxdb_v2 404 bucket not found' — Fix Bucket & Org

Overview

The InfluxDB v2 output plugin logs this when the /api/v2/write request targets a bucket that InfluxDB cannot resolve for the given organization and token:

E! [outputs.influxdb_v2] Failed to write metric to telemetry (will be dropped: 404 Not Found): failed to parse json [404 Not Found] {"code":"not found","message":"bucket \"telemetry\" not found"}

Because the plugin sees this as a non-retryable 4xx, metrics are dropped, not buffered — a silent data-loss condition until the config is fixed.

Symptoms

• Telegraf logs 404 Not Found with bucket "..." not found every flush.
• The message says will be dropped — points are discarded rather than queued.
• The InfluxDB UI shows a bucket with a similar but not identical name (case, whitespace, or a stale one).
• A different token or org value makes the same write succeed.

Common Root Causes

• Bucket does not exist in the target organization — never created, or created in a different org.
• Bucket name mismatch — trailing space, wrong case, or the display name versus the ID.
• Wrong organization value — the token is valid but scoped to another org, so the bucket is invisible.
• Token lacks read access to the bucket, which InfluxDB reports as a 404 rather than a 403 to avoid leaking existence.
• Pointing the influxdb_v2 plugin at a 1.x server whose /api/v2/write compatibility layer maps buckets to db/rp differently.

Diagnostic Workflow

Print the effective v2 output config and confirm each field:

[[outputs.influxdb_v2]]
  urls = ["http://influxdb:8086"]
  token = "${INFLUX_TOKEN}"
  organization = "devops"
  bucket = "telemetry"

List the buckets that the token can actually see — this is the definitive check:

influx bucket list --host http://influxdb:8086 \
  --token "$INFLUX_TOKEN" --org devops

If the bucket is missing here but visible in the UI, the token or org is wrong. Reproduce the exact write the plugin performs:

curl -i -XPOST "http://influxdb:8086/api/v2/write?org=devops&bucket=telemetry&precision=ns" \
  -H "Authorization: Token $INFLUX_TOKEN" \
  --data-binary 'probe,host=diag value=1'

A 204 No Content means the triple (org, bucket, token) is correct. A 404 with bucket not found confirms the mismatch. Create the bucket if it is genuinely absent:

influx bucket create --name telemetry --org devops --retention 720h \
  --host http://influxdb:8086 --token "$INFLUX_TOKEN"

Example Root Cause Analysis

An operator copied a working telegraf.conf from staging to production. Both used organization = "devops", but the production token had been minted under an org literally named devops-prod. influx bucket list with the production token returned an empty set, proving the token could not see any bucket in devops. Setting organization = "devops-prod" to match the token’s scope resolved the 404 immediately. The lesson: the org string must match the org the token belongs to, not just an org that happens to own the bucket.

Prevention Best Practices

• Reference buckets and orgs through environment variables so staging and production values never get copied by accident.
• Create the bucket as part of provisioning (Terraform influxdb_bucket or an influx bucket create bootstrap step) so it exists before Telegraf starts.
• Scope each Telegraf token to a single bucket with write permission and verify it with influx bucket list in CI.
• Alert on Telegraf’s internal write error metric; because v2 drops on 404, buffer depth will not warn you.
• Keep the plugin/version aligned: influxdb_v2 for 2.x and Cloud, influxdb for 1.x.

Quick Command Reference

# List buckets the token can see (definitive check)
influx bucket list --host http://influxdb:8086 --token "$INFLUX_TOKEN" --org devops

# Reproduce the v2 write
curl -i -XPOST "http://influxdb:8086/api/v2/write?org=devops&bucket=telemetry" \
  -H "Authorization: Token $INFLUX_TOKEN" --data-binary 'probe value=1'

# Create the bucket if missing
influx bucket create --name telemetry --org devops --retention 720h \
  --token "$INFLUX_TOKEN"

# Show effective config
telegraf --config /etc/telegraf/telegraf.conf config | grep -A8 influxdb_v2

Conclusion

A outputs.influxdb_v2 404 bucket not found almost always comes down to a three-way mismatch between bucket name, organization, and token scope — and because InfluxDB hides buckets a token cannot read, a 404 can really mean “not permitted.” Use influx bucket list with the exact token to see the truth, then curl the write to confirm. Remember that v2 drops these metrics, so fix it fast. For auth-layer failures see the 401 Unauthorized guide. More fixes in the Telegraf guides.