diff --git a/global/overlay/etc/puppet/cosmos-rules.yaml b/global/overlay/etc/puppet/cosmos-rules.yaml
index adb4bfb6..900f86a8 100644
--- a/global/overlay/etc/puppet/cosmos-rules.yaml
+++ b/global/overlay/etc/puppet/cosmos-rules.yaml
@@ -828,6 +828,8 @@ web-1.qa.sveidas.se:
 
 log.qa.sveidas.se:
    sunet_iaas_cloud:
+   eid::dockerhost:
+   eid::telegraf:
    autoupdate:
    eidas_log:
    sunet::rsyslog:
diff --git a/global/overlay/etc/puppet/modules/eid/manifests/telegraf.pp b/global/overlay/etc/puppet/modules/eid/manifests/telegraf.pp
new file mode 100644
index 00000000..6d7fe3c0
--- /dev/null
+++ b/global/overlay/etc/puppet/modules/eid/manifests/telegraf.pp
@@ -0,0 +1,25 @@
+class eid::telegraf($version="stable") {
+   $influxdb2_token = hiera("influxdb2_token","NOT_SET_IN_HIERA")
+   file {['/etc/telegraf','/etc/telegraf/telegraf.conf.d']: ensure => directory } =>
+   concat {'/etc/telegraf/telegraf.conf':
+      owner     => 'root',
+      group     => 'root',
+      mode      => '0644',
+      notify    => Sunet::Docker_run['telegraf']
+   }
+   
+   glob(["/etc/telegraf/telegraf.conf.d/**.conf"]).each |Integer $index, String $file| {
+      concat::fragment { $file: 
+         target => "/etc/telegraf/telegraf.conf",
+         source => $file,
+         order  => $index
+      }
+   }
+
+   sunet::docker_run {"telegraf": 
+      image     => "docker.sunet.se/eduid/telegraf",
+      image_tag => $version,
+      volumes   => ["/dev/log:/dev/log","/var/log:/var/log","/etc/telegraf:/etc/telegraf"],
+      env       => ["INFLUXDB2_TOKEN=$influxdb2_token"]
+   }
+}