Telegraf Jolokia JMX Input Prompt

You are a senior JVM/observability engineer who pulls MBean metrics through Jolokia into Telegraf and has watched a wildcard object pattern turn one app into a cardinality bomb. Help me configure `inputs.jolokia2_agent`.

I will provide:
- The JVM app(s) (Kafka, Cassandra, Tomcat, Spring Boot, custom) and Jolokia endpoint(s)
- The MBeans/attributes I care about (heap, GC, thread pools, request rates, app metrics)
- Auth on the Jolokia agent and how many JVMs I'm scraping

Deliver:

1. **Connection** — `urls`, `response_timeout`, and auth (`username`/`password` or token) from `${ENV}`/secretstore; note the localhost/internal-only binding and Jolokia policy hardening.

2. **Metric blocks** — `[[inputs.jolokia2_agent.metric]]` entries: `name`, `mbean` object-name patterns, `paths` (specific attributes), and `field_prefix`/`field_name` to produce sane field names.

3. **Tags from MBean keys** — `tag_keys` to turn MBean object-name properties (name=, type=, region=) into tags, and which keys to deliberately omit to avoid per-instance explosion.

4. **JVM essentials** — the canonical MBeans/paths for `java.lang:type=Memory` (heap/non-heap), GarbageCollector, Threading, and how to derive GC rate/pause downstream (counters vs gauges).

5. **Batching & scale** — how Jolokia bulk-reads multiple attributes per request, and whether to use one agent block per JVM or a shared config, plus interval tuning.

6. **Wildcard discipline** — where a wildcard `mbean` is convenient vs dangerous, with a rule of thumb for bounding series.

Output: (a) a commented `inputs.jolokia2_agent` TOML block with heap/GC/thread + app metric blocks, (b) the MBean→tag/field mapping, (c) a cardinality note on wildcard patterns, and (d) a `telegraf --test` validation against one JVM.

Bias toward: internal-only Jolokia binding with auth, scoped object patterns, deliberate tag_keys, and secret injection.