Hi,
I am trying to send logs to zabbix server using logstash zabbix output.
Sample log file contents
2015-11-11 10:27:40.8798 FATAL Some Service Providers are missing data required by FAS: TestServiceProvider-7
2015-11-11 10:29:40.8798 FATAL Some Service Providers are missing data required by FAS: TestServiceProvider-7
logstash.conf file as below
input {
file {
type => "FASLoader_alert"
path => "/opt/logstash/bin/fasAlerts/FASLoader_Alert.log"
}
}
filter {
grok{
match => [ "@message", "(error|ERROR|CRITICAL|FATAL)" ]
add_tag => [ "fas-alerts" ]
# add_field => { "zabbix_host" => "ELK" "zkey" => "hello"}
}
mutate {
add_field => { "[@metadata][zabbix_host]" => "log[/opt/logstash/bin/fasAlerts/FASLoader_Alert.log,FATAL]" }
}
}
output {
stdout { codec => rubydebug }
zabbix {
zabbix_host => "[@metadata][zabbix_host]"
}
}
When I start logstash, then it shows following error.
Logstash startup completed
{
"message" => "2015-09-03 12:00:40.8798 FATAL Some Service Providers are missing data required by FAS: TestServiceProvider-1",
"@version" => "1",
"@timestamp" => "2015-11-20T09:34:09.794Z",
"host" => "host-namei",
"path" => "/opt/logstash/bin/fasAlerts/FASLoader_Alert.log",
"type" => "FASLoader_alert",
"tags" => [
[0] "_grokparsefailure"
]
}
NoMethodError: undefined method `start_with?' for nil:NilClass
[] at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.3-java/lib/logstash/event.rb:126
field_check at /opt/logstash/vendor/local_gems/9054c277/logstash-output-zabbix-1.0.0/lib/logstash/outputs/zabbix.rb:104
kv_check at /opt/logstash/vendor/local_gems/9054c277/logstash-output-zabbix-1.0.0/lib/logstash/outputs/zabbix.rb:116
each at org/jruby/RubyArray.java:1613
kv_check at /opt/logstash/vendor/local_gems/9054c277/logstash-output-zabbix-1.0.0/lib/logstash/outputs/zabbix.rb:115
validate_fields at /opt/logstash/vendor/local_gems/9054c277/logstash-output-zabbix-1.0.0/lib/logstash/outputs/zabbix.rb:125
step at org/jruby/RubyRange.java:578
validate_fields at /opt/logstash/vendor/local_gems/9054c277/logstash-output-zabbix-1.0.0/lib/logstash/outputs/zabbix.rb:124
format_request at /opt/logstash/vendor/local_gems/9054c277/logstash-output-zabbix-1.0.0/lib/logstash/outputs/zabbix.rb:138
tcp_send at /opt/logstash/vendor/local_gems/9054c277/logstash-output-zabbix-1.0.0/lib/logstash/outputs/zabbix.rb:201
open at org/jruby/RubyIO.java:1183
tcp_send at /opt/logstash/vendor/local_gems/9054c277/logstash-output-zabbix-1.0.0/lib/logstash/outputs/zabbix.rb:200
send_to_zabbix at /opt/logstash/vendor/local_gems/9054c277/logstash-output-zabbix-1.0.0/lib/logstash/outputs/zabbix.rb:223
timeout at org/jruby/ext/timeout/Timeout.java:126
send_to_zabbix at /opt/logstash/vendor/local_gems/9054c277/logstash-output-zabbix-1.0.0/lib/logstash/outputs/zabbix.rb:222
receive at /opt/logstash/vendor/local_gems/9054c277/logstash-output-zabbix-1.0.0/lib/logstash/outputs/zabbix.rb:239
handle at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.3-java/lib/logstash/outputs/base.rb:88
output_func at (eval):78
outputworker at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.3-java/lib/logstash/pipeline.rb:244
start_outputs at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.3-java/lib/logstash/pipeline.rb:166
Can anybody tell whats wrong in my configuration?
Zabbix monitoring is running on 127.0.0.1.
I have created 2 hosts form zabbix frontend as below
