class LogStash::Outputs::Zabbix
The Zabbix
output is used to send item data (key/value pairs) to a Zabbix
server. The event `@timestamp` will automatically be associated with the Zabbix
item data.
The Zabbix
Sender protocol is described at www.zabbix.org/wiki/Docs/protocols/zabbix_sender/2.0 Zabbix
uses a kind of nested key/value store.
- source,txt
-
host
├── item1 │ └── value1 ├── item2 │ └── value2 ├── ... │ └── ... ├── item_n │ └── value_n
Each “host” is an identifier, and each item is associated with that host. Items are typed on the Zabbix
side. You can send numbers as strings and Zabbix
will Do The Right Thing.
In the Zabbix
UI, ensure that your hostname matches the value referenced by `zabbix_host`. Create the item with the key as it appears in the field referenced by `zabbix_key`. In the item configuration window, ensure that the type dropdown is set to Zabbix
Trapper. Also be sure to set the type of information that Zabbix
should expect for this item.
This plugin does not currently send in batches. While it is possible to do so, this is not supported. Be careful not to flood your Zabbix
server with too many events per second.
NOTE: This plugin will log a warning if a necessary field is missing. It will not attempt to resend if Zabbix
is down, but will log an error message.
Public Instance Methods
# File lib/logstash/outputs/zabbix.rb, line 106 def field_check(event, fieldname) if !event.get(fieldname) @logger.warn("Field referenced by #{fieldname} is missing") false else true end end
# File lib/logstash/outputs/zabbix.rb, line 137 def format_request(event) # The nested `clock` value is the event timestamp # The ending `clock` value is "now" so Zabbix knows it's not receiving stale # data. validated = validate_fields(event) data = [] (0..validated.length-1).step(2) do |idx| data << { "host" => event.get(@zabbix_host), "key" => event.get(validated[idx]), "value" => event.get(validated[idx+1]), "clock" => event.get("@timestamp").to_i } end { "request" => "sender data", "data" => data, "clock" => Time.now.to_i, } end
# File lib/logstash/outputs/zabbix.rb, line 171 def info_check(event, data) # {"response"=>"success", "info"=>"processed 0; Failed 1; Total 1; seconds spent: 0.000018"} if !data.is_a?(Hash) @logger.error("Zabbix server at #{@zabbix_server_host} responded atypically.", :returned_data => data ) return false end # Prune the semicolons, then turn it into an array info = data["info"].tr(';', '').split() # ["processed", "0", "Failed", "1", "Total", "1", "seconds", "spent:", "0.000018"] failed = info[3].to_i total = info[5].to_i if failed == total @logger.warn("Zabbix server at #{@zabbix_server_host} rejected all items sent.", :zabbix_host => event.get(@zabbix_host) ) false elsif failed > 0 @logger.warn("Zabbix server at #{@zabbix_server_host} rejected #{info[3]} item(s).", :zabbix_host => event.get(@zabbix_host) ) false elsif failed == 0 && total > 0 true else false end end
# File lib/logstash/outputs/zabbix.rb, line 116 def kv_check(event, key_field, value_field) errors = 0 for field in [key_field, value_field] errors += 1 unless field_check(event, field) end errors < 1 ? true : false end
# File lib/logstash/outputs/zabbix.rb, line 239 def receive(event) return unless field_check(event, @zabbix_host) send_to_zabbix(event) end
# File lib/logstash/outputs/zabbix.rb, line 88 def register if !@zabbix_key.nil? && !@multi_value.nil? @logger.warn("Cannot use multi_value in conjunction with zabbix_key/zabbix_value. Ignoring zabbix_key.") end # We're only going to use @multi_value in the end, so let's build it from # @zabbix_key and @zabbix_value if it is empty (single value configuration). if @multi_value.nil? @multi_value = [ @zabbix_key, @zabbix_value ] end if @multi_value.length % 2 == 1 raise LogStash::ConfigurationError, I18n.t("logstash.agent.configuration.invalid_plugin_register", :plugin => "output", :type => "zabbix", :error => "Invalid zabbix configuration #{@multi_value}. multi_value requires an even number of elements as ['zabbix_key1', 'zabbix_value1', 'zabbix_key2', 'zabbix_value2']") end end
# File lib/logstash/outputs/zabbix.rb, line 158 def response_check(event, data) # {"response"=>"success", "info"=>"Processed 0; Failed 1; Total 1; seconds spent: 0.000018"} unless data["response"] == "success" @logger.error("Failed to send event to Zabbix", :zabbix_response => data, :event => event ) false else true end end
# File lib/logstash/outputs/zabbix.rb, line 223 def send_to_zabbix(event) begin Timeout::timeout(@timeout) do tcp_send(event) end rescue Timeout::Error @logger.warn("Connection attempt to Zabbix server timed out.", :server => @zabbix_server_host, :port => @zabbix_server_port.to_s, :timeout => @timeout.to_s ) false end end
# File lib/logstash/outputs/zabbix.rb, line 201 def tcp_send(event) begin TCPSocket.open(@zabbix_server_host, @zabbix_server_port) do |sock| data = format_request(event) sock.print ZabbixProtocol.dump(data) resp = ZabbixProtocol.load(sock.read) @logger.debug? and @logger.debug("Zabbix server response", :response => resp, :data => data) # Log whether the key/value pairs accepted info_check(event, resp) # Did the message get received by Zabbix? response_check(event, resp) end rescue Errno::ECONNREFUSED, Errno::EHOSTUNREACH, Errno::ECONNRESET @logger.error("Connection error. Unable to connect to Zabbix server", :server => @zabbix_server_host, :port => @zabbix_server_port.to_s ) false end end
# File lib/logstash/outputs/zabbix.rb, line 125 def validate_fields(event) found = [] (0..@multi_value.length-1).step(2) do |idx| if kv_check(event, @multi_value[idx], @multi_value[idx+1]) found << @multi_value[idx] found << @multi_value[idx+1] end end found end