Hello there!
I use logstash 6.1.0 with logstash-output-nagios-nsca plugin for sending Errors from my log to the nagios server.
My config is:
input {
file {
path => "/opt/mylog.log"
start_position => "beginning"
}
}
filter {
grok {
match => { "message" => " ERROR " }
add_field => { "found" => "yes" }
}
}
output {
if [found]
{
nagios_nsca {
id => "010101"
codec => "plain"
host => "nagios.server.com"
port => 5667
send_nsca_bin => "/opt/nsca/send_nsca"
send_nsca_config => "/opt/nsca/send_nsca.cfg"
message_format => "%{@timestamp} %{host}: Error message found: %{message}"
nagios_host => "myhost.server.com"
nagios_service => "ncsa_log_service"
nagios_status => "2"
}
}
}
But when ERROR is happened logstash throws some error like:
[2017-12-22T19:04:45,972][WARN ][logstash.outputs.nagiosnsca] Skipping nagios_nsca output; error calling send_nsca {:error=>#<TypeError: no implicit conversion of Fixnum into String>, :nagios_nsca_command=>"/opt/nsca/send_nsca -H nagios.server.com -p 5667 -d : -c /opt/nsca/send_nsca.cfg", :message=>"myhost.server.com:ncsa_log_service:2:2017-12-22T15:04:45.603Z rhel7: Error message found: 2017-12-22 19:04:05 ERROR SftpOperations - JSCH -> SSH_MSG_SERVICE_ACCEPT received", :missed_event=>#LogStash::Event:0x118315a2}
any ideas how to fix it?
P.S. Manualy like echo "server\tservice\tstatus\tmessage" | /opt/nsca/send_nsca -H nagios.server.com -d : -p 5667 -c /opt/nsca/send_nsca.cfg works fine