Class: LogStash::Outputs::Zabbix

Inherits:
Base
  • Object
show all
Defined in:
lib/logstash/outputs/zabbix.rb

Overview

The Zabbix output is used to send item data (key/value pairs) to a Zabbix server. The event ‘@timestamp` will automatically be associated with the Zabbix item data.

The Zabbix Sender protocol is described at www.zabbix.org/wiki/Docs/protocols/zabbix_sender/2.0 Zabbix uses a kind of nested key/value store.

source,txt

host

├── item1
│     └── value1
├── item2
│     └── value2
├── ...
│     └── ...
├── item_n
│     └── value_n

Each “host” is an identifier, and each item is associated with that host. Items are typed on the Zabbix side. You can send numbers as strings and Zabbix will Do The Right Thing.

In the Zabbix UI, ensure that your hostname matches the value referenced by ‘zabbix_host`. Create the item with the key as it appears in the field referenced by `zabbix_key`. In the item configuration window, ensure that the type dropdown is set to Zabbix Trapper. Also be sure to set the type of information that Zabbix should expect for this item.

This plugin does not currently send in batches. While it is possible to do so, this is not supported. Be careful not to flood your Zabbix server with too many events per second.

NOTE: This plugin will log a warning if a necessary field is missing. It will not attempt to resend if Zabbix is down, but will log an error message.

Instance Method Summary collapse

Instance Method Details

#field_check(event, fieldname) ⇒ Object 



106
107
108
109
110
111
112
113
 
# File 'lib/logstash/outputs/zabbix.rb', line 106

def field_check(event, fieldname)
  if !event.get(fieldname)
    @logger.warn("Field referenced by #{fieldname} is missing")
    false
  else
    true
  end
end

#format_request(event) ⇒ Object 



137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
 
# File 'lib/logstash/outputs/zabbix.rb', line 137

def format_request(event)
  # The nested `clock` value is the event timestamp
  # The ending `clock` value is "now" so Zabbix knows it's not receiving stale
  # data.
  validated = validate_fields(event)
  data = []
  (0..validated.length-1).step(2) do |idx|
    data << {
      "host"  => event.get(@zabbix_host),
      "key"   => event.get(validated[idx]),
      "value" => event.get(validated[idx+1]),
      "clock" => event.get("@timestamp").to_i
    }
  end
  {
    "request" => "sender data",
    "data" => data,
    "clock" => Time.now.to_i,
  }
end

#info_check(event, data) ⇒ Object 



171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
 
# File 'lib/logstash/outputs/zabbix.rb', line 171

def info_check(event, data)
  # {"response"=>"success", "info"=>"processed 0; Failed 1; Total 1; seconds spent: 0.000018"}
  if !data.is_a?(Hash)
    @logger.error("Zabbix server at #{@zabbix_server_host} responded atypically.",
      :returned_data => data
    )
    return false
  end
  # Prune the semicolons, then turn it into an array
  info = data["info"].tr(';', '').split()
  # ["processed", "0", "Failed", "1", "Total", "1", "seconds", "spent:", "0.000018"]
  failed = info[3].to_i
  total = info[5].to_i
  if failed == total
    @logger.warn("Zabbix server at #{@zabbix_server_host} rejected all items sent.",
      :zabbix_host => event.get(@zabbix_host)
    )
    false
  elsif failed > 0
    @logger.warn("Zabbix server at #{@zabbix_server_host} rejected #{info[3]} item(s).",
      :zabbix_host => event.get(@zabbix_host)
    )
    false
  elsif failed == 0 && total > 0
    true
  else
    false
  end
end

#kv_check(event, key_field, value_field) ⇒ Object 



116
117
118
119
120
121
122
 
# File 'lib/logstash/outputs/zabbix.rb', line 116

def kv_check(event, key_field, value_field)
  errors = 0
  for field in [key_field, value_field]
    errors += 1 unless field_check(event, field)
  end
  errors < 1 ? true : false
end

#receive(event) ⇒ Object 



239
240
241
242
243
 
# File 'lib/logstash/outputs/zabbix.rb', line 239

def receive(event)

  return unless field_check(event, @zabbix_host)
  send_to_zabbix(event)
end

#register ⇒ Object 



88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
 
# File 'lib/logstash/outputs/zabbix.rb', line 88

def register
  if !@zabbix_key.nil? && !@multi_value.nil?
    @logger.warn("Cannot use multi_value in conjunction with zabbix_key/zabbix_value.  Ignoring zabbix_key.")
  end

  # We're only going to use @multi_value in the end, so let's build it from
  # @zabbix_key and @zabbix_value if it is empty (single value configuration).
  if @multi_value.nil?
    @multi_value = [ @zabbix_key, @zabbix_value ]
  end
  if @multi_value.length % 2 == 1
    raise LogStash::ConfigurationError, I18n.t("logstash.agent.configuration.invalid_plugin_register",
      :plugin => "output", :type => "zabbix",
      :error => "Invalid zabbix configuration #{@multi_value}. multi_value requires an even number of elements as ['zabbix_key1', 'zabbix_value1', 'zabbix_key2', 'zabbix_value2']")
  end
end

#response_check(event, data) ⇒ Object 



158
159
160
161
162
163
164
165
166
167
168
169
 
# File 'lib/logstash/outputs/zabbix.rb', line 158

def response_check(event, data)
  # {"response"=>"success", "info"=>"Processed 0; Failed 1; Total 1; seconds spent: 0.000018"}
  unless data["response"] == "success"
    @logger.error("Failed to send event to Zabbix",
      :zabbix_response => data,
      :event => event
    )
    false
  else
    true
  end
end

#send_to_zabbix(event) ⇒ Object 



223
224
225
226
227
228
229
230
231
232
233
234
235
236
 
# File 'lib/logstash/outputs/zabbix.rb', line 223

def send_to_zabbix(event)
  begin
    Timeout::timeout(@timeout) do
      tcp_send(event)
    end
  rescue Timeout::Error
    @logger.warn("Connection attempt to Zabbix server timed out.",
      :server => @zabbix_server_host,
      :port => @zabbix_server_port.to_s,
      :timeout => @timeout.to_s
    )
    false
  end
end

#tcp_send(event) ⇒ Object 



201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
 
# File 'lib/logstash/outputs/zabbix.rb', line 201

def tcp_send(event)
  begin
    TCPSocket.open(@zabbix_server_host, @zabbix_server_port) do |sock|
      data = format_request(event)
      sock.print ZabbixProtocol.dump(data)
      resp = ZabbixProtocol.load(sock.read)
      @logger.debug? and @logger.debug("Zabbix server response",
                            :response => resp, :data => data)
      # Log whether the key/value pairs accepted
      info_check(event, resp)
      # Did the message get received by Zabbix?
      response_check(event, resp)
    end
  rescue Errno::ECONNREFUSED, Errno::EHOSTUNREACH, Errno::ECONNRESET
    @logger.error("Connection error.  Unable to connect to Zabbix server",
      :server => @zabbix_server_host,
      :port => @zabbix_server_port.to_s
    )
    false
  end
end

#validate_fields(event) ⇒ Object 



125
126
127
128
129
130
131
132
133
134
 
# File 'lib/logstash/outputs/zabbix.rb', line 125

def validate_fields(event)
  found = []
  (0..@multi_value.length-1).step(2) do |idx|
    if kv_check(event, @multi_value[idx], @multi_value[idx+1])
      found << @multi_value[idx]
      found << @multi_value[idx+1]
    end
  end
  found
end