Class: LogStash::Outputs::Zabbix

Inherits:
Base
  • Object
show all
Defined in:
lib/logstash/outputs/zabbix.rb

Overview

The Zabbix output is used to send item data (key/value pairs) to a Zabbix server. The event ‘@timestamp` will automatically be associated with the Zabbix item data.

The Zabbix Sender protocol is described at www.zabbix.org/wiki/Docs/protocols/zabbix_sender/2.0 Zabbix uses a kind of nested key/value store.

source,txt

host

├── item1
│     └── value1
├── item2
│     └── value2
├── ...
│     └── ...
├── item_n
│     └── value_n

Each “host” is an identifier, and each item is associated with that host. Items are typed on the Zabbix side. You can send numbers as strings and Zabbix will Do The Right Thing.

In the Zabbix UI, ensure that your hostname matches the value referenced by ‘zabbix_host`. Create the item with the key as it appears in the field referenced by `zabbix_key`. In the item configuration window, ensure that the type dropdown is set to Zabbix Trapper. Also be sure to set the type of information that Zabbix should expect for this item.

This plugin does not currently send in batches. While it is possible to do so, this is not supported. Be careful not to flood your Zabbix server with too many events per second.

NOTE: This plugin will log a warning if a necessary field is missing. It will not attempt to resend if Zabbix is down, but will log an error message.

Instance Method Summary collapse

Instance Method Details

#field_check(event, fieldname) ⇒ Object 



103
104
105
106
107
108
109
110
 
# File 'lib/logstash/outputs/zabbix.rb', line 103

def field_check(event, fieldname)
  if !event[fieldname]
    @logger.warn("Field referenced by #{fieldname} is missing")
    false
  else
    true
  end
end

#format_request(event) ⇒ Object 



134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
 
# File 'lib/logstash/outputs/zabbix.rb', line 134

def format_request(event)
  # The nested `clock` value is the event timestamp
  # The ending `clock` value is "now" so Zabbix knows it's not receiving stale
  # data.
  validated = validate_fields(event)
  data = []
  (0..validated.length-1).step(2) do |idx|
    data << {
      "host"  => event[@zabbix_host],
      "key"   => event[validated[idx]],
      "value" => event[validated[idx+1]],
      "clock" => event["@timestamp"].to_i
    }
  end
  {
    "request" => "sender data",
    "data" => data,
    "clock" => Time.now.to_i,
  }
end

#info_check(event, data) ⇒ Object 



168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
 
# File 'lib/logstash/outputs/zabbix.rb', line 168

def info_check(event, data)
  # {"response"=>"success", "info"=>"processed 0; Failed 1; Total 1; seconds spent: 0.000018"}
  if !data.is_a?(Hash)
    @logger.error("Zabbix server at #{@zabbix_server_host} responded atypically.",
      :returned_data => data
    )
    return false
  end
  # Prune the semicolons, then turn it into an array
  info = data["info"].tr(';', '').split()
  # ["processed", "0", "Failed", "1", "Total", "1", "seconds", "spent:", "0.000018"]
  failed = info[3].to_i
  total = info[5].to_i
  if failed == total
    @logger.warn("Zabbix server at #{@zabbix_server_host} rejected all items sent.",
      :zabbix_host => event[@zabbix_host]
    )
    false
  elsif failed > 0
    @logger.warn("Zabbix server at #{@zabbix_server_host} rejected #{info[3]} item(s).",
      :zabbix_host => event[@zabbix_host]
    )
    false
  elsif failed == 0 && total > 0
    true
  else
    false
  end
end

#kv_check(event, key_field, value_field) ⇒ Object 



113
114
115
116
117
118
119
 
# File 'lib/logstash/outputs/zabbix.rb', line 113

def kv_check(event, key_field, value_field)
  errors = 0
  for field in [key_field, value_field]
    errors += 1 unless field_check(event, field)
  end
  errors < 1 ? true : false
end

#receive(event) ⇒ Object 



236
237
238
239
240
 
# File 'lib/logstash/outputs/zabbix.rb', line 236

def receive(event)
  
  return unless field_check(event, @zabbix_host)
  send_to_zabbix(event)
end

#register ⇒ Object 



85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
 
# File 'lib/logstash/outputs/zabbix.rb', line 85

def register
  if !@zabbix_key.nil? && !@multi_value.nil?
    @logger.warn("Cannot use multi_value in conjunction with zabbix_key/zabbix_value.  Ignoring zabbix_key.")
  end

  # We're only going to use @multi_value in the end, so let's build it from
  # @zabbix_key and @zabbix_value if it is empty (single value configuration).
  if @multi_value.nil?
    @multi_value = [ @zabbix_key, @zabbix_value ]
  end
  if @multi_value.length % 2 == 1
    raise LogStash::ConfigurationError, I18n.t("logstash.agent.configuration.invalid_plugin_register",
      :plugin => "output", :type => "zabbix",
      :error => "Invalid zabbix configuration #{@multi_value}. multi_value requires an even number of elements as ['zabbix_key1', 'zabbix_value1', 'zabbix_key2', 'zabbix_value2']")
  end
end

#response_check(event, data) ⇒ Object 



155
156
157
158
159
160
161
162
163
164
165
166
 
# File 'lib/logstash/outputs/zabbix.rb', line 155

def response_check(event, data)
  # {"response"=>"success", "info"=>"Processed 0; Failed 1; Total 1; seconds spent: 0.000018"}
  unless data["response"] == "success"
    @logger.error("Failed to send event to Zabbix",
      :zabbix_response => data,
      :event => event
    )
    false
  else
    true
  end
end

#send_to_zabbix(event) ⇒ Object 



220
221
222
223
224
225
226
227
228
229
230
231
232
233
 
# File 'lib/logstash/outputs/zabbix.rb', line 220

def send_to_zabbix(event)
  begin
    Timeout::timeout(@timeout) do
      tcp_send(event)
    end
  rescue Timeout::Error
    @logger.warn("Connection attempt to Zabbix server timed out.",
      :server => @zabbix_server_host,
      :port => @zabbix_server_port.to_s,
      :timeout => @timeout.to_s
    )
    false
  end
end

#tcp_send(event) ⇒ Object 



198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
 
# File 'lib/logstash/outputs/zabbix.rb', line 198

def tcp_send(event)
  begin
    TCPSocket.open(@zabbix_server_host, @zabbix_server_port) do |sock|
      data = format_request(event)
      sock.print ZabbixProtocol.dump(data)
      resp = ZabbixProtocol.load(sock.read)
      @logger.debug? and @logger.debug("Zabbix server response",
                            :response => resp, :data => data)
      # Log whether the key/value pairs accepted
      info_check(event, resp)
      # Did the message get received by Zabbix?
      response_check(event, resp)
    end
  rescue Errno::ECONNREFUSED, Errno::EHOSTUNREACH, Errno::ECONNRESET
    @logger.error("Connection error.  Unable to connect to Zabbix server",
      :server => @zabbix_server_host,
      :port => @zabbix_server_port.to_s
    )
    false
  end
end

#validate_fields(event) ⇒ Object 



122
123
124
125
126
127
128
129
130
131
 
# File 'lib/logstash/outputs/zabbix.rb', line 122

def validate_fields(event)
  found = []
  (0..@multi_value.length-1).step(2) do |idx|
    if kv_check(event, @multi_value[idx], @multi_value[idx+1])
      found << @multi_value[idx]
      found << @multi_value[idx+1]
    end
  end
  found
end