# Logstash with zabbix output ISSUE **URL:** \ **Category:** Logstash\ **Created:** [May 28, 2015, 12:21am UTC](https://discuss.elastic.co/t/logstash-with-zabbix-output-issue/1434 "2015-05-28T00:21:49Z")\ **Posts on this page:** 9\ **Page:** 2
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [June 9, 2015, 6:49pm UTC](https://discuss.elastic.co/t/logstash-with-zabbix-output-issue/1434/21 "2015-06-09T18:49:56Z")
Check your zabbix logs and the item type. It might be sending but not adding the value because of a mismatch, but the logs should indicate what's going on (or at least, hopefully, an error message). ---
**Author:** ![shivam\_singh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shivam_singh/32/4225_2.png) [@shivam\_singh](https://discuss.elastic.co/u/shivam_singh)\ **Post date:** [August 17, 2015, 2:02pm UTC](https://discuss.elastic.co/t/logstash-with-zabbix-output-issue/1434/22 "2015-08-17T14:02:55Z")
I am Also getting an error while sending the output to zabbix. My config file... input { lumberjack { port =\> 5000 type =\> "logs" ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt" ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key" } } filter { grok { match =\> ["message", "%{SYSLOGBASE} %{DATA:data}"] add\_tag =\> ["zabbix-sender"] add\_field =\> [ "zabbix\_host", "%{source\_host}", "zabbix\_item", "item.key", "send\_field", "data" ] } } output{ elasticsearch{ host =\> localhost } } output { zabbix { zabbix\_host =\> "log\_getter" zabbix\_key =\>"hello" zabbix\_server\_host =\> "10.0.30.215" } } ERROR: Field referenced by log\_getter is missing {:level=\>:warn} ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [August 17, 2015, 2:29pm UTC](https://discuss.elastic.co/t/logstash-with-zabbix-output-issue/1434/23 "2015-08-17T14:29:49Z")
The `zabbix_host` directive is supposed to point to a field name, rather than be a plain string host name. Please see [this passage from the documentation](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-zabbix.html#plugins-outputs-zabbix-zabbix_host): ``` zabbix_host This is a required setting. Value type is string There is no default value for this setting. The field name which holds the Zabbix host name. This can be a sub-field of the @metadata field. ``` I see from your grok statement that you're adding a `zabbix_host` field from the `source_host` field. This is adding a redundant field. You could just replace `"log_getter"` with `"source_host"` to use the value of `source_host`. This value _must_ be a valid host in your Zabbix server, though, whether a short hostname or a fully-qualified domain name. ---
**Author:** ![shivam\_singh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shivam_singh/32/4225_2.png) [@shivam\_singh](https://discuss.elastic.co/u/shivam_singh)\ **Post date:** [August 17, 2015, 2:36pm UTC](https://discuss.elastic.co/t/logstash-with-zabbix-output-issue/1434/24 "2015-08-17T14:36:42Z")
i have a host named ELK in zabbix server with a "log\_getter" item and "hello" as key(Zabbix trapper). ---
**Author:** ![shivam\_singh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shivam_singh/32/4225_2.png) [@shivam\_singh](https://discuss.elastic.co/u/shivam_singh)\ **Post date:** [August 17, 2015, 2:40pm UTC](https://discuss.elastic.co/t/logstash-with-zabbix-output-issue/1434/25 "2015-08-17T14:40:46Z")
Have checked with commenting the GROK filter part, still it is giving the same error. ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [August 17, 2015, 3:20pm UTC](https://discuss.elastic.co/t/logstash-with-zabbix-output-issue/1434/26 "2015-08-17T15:20:02Z")
the host is named ELK? All caps? If so, then in your grok statement, you'd set: ``` add_field => { "zhost" => "ELK" "zkey" => "hello" } ``` and in your output you'd set: ``` zabbix { zabbix_host => "zhost" zabbix_key =>"zkey" zabbix_server_host => "10.0.30.215" } ``` In the output block, `zabbix_host` and `zabbix_key` _must_ reference fields, not strings. This configuration will send strings to the "hello" key on host "ELK". ---
**Author:** ![shivam\_singh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shivam_singh/32/4225_2.png) [@shivam\_singh](https://discuss.elastic.co/u/shivam_singh)\ **Post date:** [August 17, 2015, 3:27pm UTC](https://discuss.elastic.co/t/logstash-with-zabbix-output-issue/1434/27 "2015-08-17T15:27:09Z")
Thanks...it seems to work. How do I know on the zabbix server end that I am getting the messages. And Based on it how do I do alerting ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [August 17, 2015, 3:50pm UTC](https://discuss.elastic.co/t/logstash-with-zabbix-output-issue/1434/28 "2015-08-17T15:50:49Z")
Those are questions better sent to the forums on [zabbix.com](http://zabbix.com) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:31am UTC](https://discuss.elastic.co/t/logstash-with-zabbix-output-issue/1434/29 "2017-07-06T05:31:45Z")
[Previous page](https://discuss.elastic.co/t/logstash-with-zabbix-output-issue/1434.md?page=1)