Class: LogStash::Outputs::Zabbix

Inherits:
Base show all
Defined in:
lib/logstash/outputs/zabbix.rb

Overview

The zabbix output is used for sending item data to zabbix via the zabbix_sender executable.

For this output to work, your event must have the following fields:

  • “zabbix_host” (the host configured in Zabbix)

  • “zabbix_item” (the item key on the host in Zabbix)

In Zabbix, create your host with the same name (no spaces in the name of the host supported) and create your item with the specified key as a Zabbix Trapper item.

The easiest way to use this output is with the grep filter. Presumably, you only want certain events matching a given pattern to send events to zabbix, so use grep to match and also to add the required fields.

 filter {
   grep {
     type => "linux-syslog"
     match => [ "@message", "(error|ERROR|CRITICAL)" ]
     add_tag => [ "zabbix-sender" ]
     add_field => [
       "zabbix_host", "%{source_host}",
       "zabbix_item", "item.key"
     ]
  }
}

output {
  zabbix {
    # only process events with this tag
    tags => "zabbix-sender"

    # specify the hostname or ip of your zabbix server
    # (defaults to localhost)
    host => "localhost"

    # specify the port to connect to (default 10051)
    port => "10051"

    # specify the path to zabbix_sender
    # (defaults to "/usr/local/bin/zabbix_sender")
    zabbix_sender => "/usr/local/bin/zabbix_sender"
  }
}

Constant Summary

Constants included from Config::Mixin

Config::Mixin::CONFIGSORT

Instance Attribute Summary

Attributes included from Config::Mixin

#config, #original_params

Attributes inherited from Plugin

#logger, #params

Instance Method Summary collapse

Methods inherited from Base

#handle, #handle_worker, #initialize, #worker_setup, #workers_not_supported

Methods included from Config::Mixin

#config_init, included

Methods inherited from Plugin

#eql?, #finished, #finished?, #hash, #initialize, #inspect, lookup, #reload, #running?, #shutdown, #teardown, #terminating?, #to_s

Constructor Details

This class inherits a constructor from LogStash::Outputs::Base

Instance Method Details

#receive(event) ⇒ Object 



66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
 
# File 'lib/logstash/outputs/zabbix.rb', line 66

def receive(event)
  return unless output?(event)
 
  if !File.exists?(@zabbix_sender)
    @logger.warn("Skipping zabbix output; zabbix_sender file is missing",
                 :zabbix_sender => @zabbix_sender, :missed_event => event)
    return
  end
 
  host = event["zabbix_host"]
  if !host
    @logger.warn("Skipping zabbix output; zabbix_host field is missing",
                 :missed_event => event)
    return
  end
  host = host.first if host.is_a?(Array)
 
  item = event["zabbix_item"]
  if !item
    @logger.warn("Skipping zabbix output; zabbix_item field is missing",
                 :missed_event => event)
    return
  end
  item = item.first if item.is_a?(Array)
 
  zmsg = event["message"]
  zmsg = zmsg.gsub("\n", "\\n")
  zmsg = zmsg.gsub(/"/, "\\\"")
 
  cmd = "#{@zabbix_sender} -z #{@host} -p #{@port} -s #{host} -k #{item} -o \"#{zmsg}\" 2>/dev/null >/dev/null"
 
  @logger.debug("Running zabbix command", :command => cmd)
  begin
    # TODO(sissel): Update this to use IO.popen so we can capture the output and
    # log it accordingly.
    system(cmd)
  rescue => e
    @logger.warn("Skipping zabbix output; error calling zabbix_sender",
                 :command => cmd, :missed_event => event,
                 :exception => e, :backtrace => e.backtrace)
  end
end

#register ⇒ Object 



61
62
63
 
# File 'lib/logstash/outputs/zabbix.rb', line 61

def register
  # nothing to do
end