Logstash-hipchat messages are not displaying in hipchat

Elastic Stack Logstash
1

Hi,

I have redirected logs recieving in logstash to hipchat.

output {
 if [type]== 'eventlog' {

    hipchat {
      room_id => '****'
      token => '****'
          }

    elasticsearch {
      hosts => ['172.30.0.206:9200']
              }
         }
      }

But in hipchat it is showing like

logstash · logstash·5:58 PM
%{message}

logstash · logstash·6:08 PM
%{message}
No content in message field. What may be the issue?

2

What does the rest of your config look like? What does the data look like?
What version are you on?

3

Logstash configuration:

input {
 tcp {
   port => 5045
   type => 'eventlog'
   codec =>"json"
     }
   }

filter {
 if [type]== 'eventlog' {

    hipchat {
      room_id => '*****'
      token => '****'
          }
    elasticsearch {
      hosts => ['172.30.0.206:9200']
              }
         }
      }

In kibana, it looks like

{
  "_index": "logstash-2016.06.14",
  "_type": "eventlog",
  "_id": "AVVNbiXCoy4-TtrOUrmi",
  "_score": null,
  "_source": {
    "EventTime": "2016-06-14 11:11:47",
    "Hostname": "xx.xx.x",
    "Keywords": 2305843009213694000,
    "EventType": "ERROR",
    "SeverityValue": 4,
    "Severity": "ERROR",
    "EventID": 216,
    "SourceName": "Microsoft-Windows-ServerManager-MultiMachine",
    "ProviderGuid": "{D8D37081-10BD-4A89-A971-1CDA6899BDB3}",
    "Version": 0,
    "Task": 17,
    "OpcodeValue": 0,
    "RecordNumber": 3369760,
    "ProcessID": 4988,
    "ThreadID": 6944,
    "Channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "Domain": "ONTASHINDIA",
    "AccountName": "Administrator",
    "UserID": "Administrator",
    "AccountType": "User",
    "Message": "Invoke method error. Server: localhost, Namespace: root\\microsoft\\windows\\servermanager, Class: MSFT_ServerManagerTasks, Method: GetCounterSamplesInTimeRange, Error: A general error occurred that is not covered by a more specific error code.",
    "Category": "Node access.",
    "Opcode": "Info",
    "serverName": "localhost",
    "namespaceName": "root\\microsoft\\windows\\servermanager",
    "wmiClassName": "MSFT_ServerManagerTasks",
    "methodName": "GetCounterSamplesInTimeRange",
    "protocol": "DCOM",
    "error": "A general error occurred that is not covered by a more specific error code.",
    "EventReceivedTime": "2016-06-14 11:11:49",
    "SourceModuleName": "eventlog",
    "SourceModuleType": "im_msvistalog",
    "@version": "1",
    "@timestamp": "2016-06-14T05:41:50.634Z",
    "host": "x.x.x.x",
    "port": 60831,
    "type": "eventlog",
    "tags": [
      "_grokparsefailure"
    ]
  },
  "fields": {
    "@timestamp": [
      1465882910634
    ]
  },
  "sort": [
    1465882910634
  ]
}

I am using nxlog in windows server to ship logs to logstash.

Version

Elasticsearch 2.2.x, Logstash 2.2.x, and Kibana 4.4.x.

4

That is not a valid config, you cannot have an output like that in a filter.

5

Oh.. Sorry. That is a copy paste mistake. correct config is :

input {
 tcp {
   port => 5045
   type => 'eventlog'
   codec =>"json"
     }
   }



filter {
    if [type] == "eventlog" and [Severity] == "WARNING" {
    drop { }
  }

  if [type] == "eventlog" and [Severity] == "INFO" {
    drop { }
  }
}


output {
 if [type]== 'eventlog' {

    hipchat {
      room_id => '****'
      token => '****'
          }

    elasticsearch {
      hosts => ['172.30.0.206:9200']
              }
         }
      }
6

As you don't have a message in your events you'll want to adjust the hipchat output's format option.

7

What format should I use in hipchat output in logstash for displaying messages?

8

Use stdout { codec => rubydebug} to see what is generated and go from there.

9

What do you want the messages sent to HipChat to contain?

10

I need Source, date time, severity level, message title, message description
in hipchat

11

Then adjust the hipchat output's format option accordingly.

hipchat {
  ...
  format => "%{SourceName} %{Severity} ..."
}

https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references

12

This worked for me.

In hipchat logs are showing in the format :

Microsoft-Windows-ServerManager-MultiMachine 2016-06-17 11:28:45 ERROR Invoke method error. Server: localhost, Namespace: root\microsoft\windows\servermanager, Class: MSFT_ServerManagerTasks, Method: GetCounterSamplesInTimeRange, Error: A general error occurred that is not covered by a more specific error code

Is it possible to make each fields in seperate lines? Like

SourceName
Date Time
Severity
Message