RabbitMQ and Zabbix Plugins

Hi there!
I've got two plugins:

  • Rabbitmq input plugin
  • Zabbix output plugin

Took some data from RabbitMQ and now i've got responseAnswer.Code filed.
Now i want to send this filed to zabbix:

if [type] == "ld.api.logger" {
        mutate {
        add_field => {
        "[@metadata][zabbix_key]" => "responseAnswer.Code"
        "zabbix_host" => "node4"
        "[@metadata][zabbix_value]" => "%{responseAnswer.Code}"
    }
   }
}

But in zabbix i see only:

09.11.2017 17:30:11	%{responseAnswer.Code}
09.11.2017 17:30:11	%{responseAnswer.Code}
09.11.2017 17:30:11	%{responseAnswer.Code}
09.11.2017 17:30:11	%{responseAnswer.Code}
09.11.2017 17:30:11	%{responseAnswer.Code}
09.11.2017 17:30:11	%{responseAnswer.Code}

How to get value of this filed? Thanks a lot!

If responseAnswer.Code is a nested field see https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references for the correct syntax.

Thank's for reply!
How can i get from dev tools information about event and fields?

How can i get from dev tools information about event and fields?

What do you mean?

thought that i could use something like this in dev tools in Kibana:

GET index/type/rabbit-*

And saw structure of events with nested field...

So, how can i get this nested field? Thanks!

Another way, opened event in Kibana like JSON and saw this:

  "_source": {
    "responseAnswer": {
      "Code": 400,
      "Message": "{\"error\":\"invalid_grant\",\"error_description\":\"The user name or password is incorrect.\"}"
    },

Made config like this:

"[@metadata][zabbix_value]" => "[_source][responseAnswer][processingCode]"

And still no value in Zabbix =(

[_source] should not be included here. Also, the subfield is Code, not processingCode.

Now i got this in zabbix:

13.11.2017 09:59:20 [responseAnswer][processingCode]`

Maybe need to use something like this? [@metadata][responseAnswer][Code]?
Dig deeper or something...

Maybe any another suggestions?
Thanks!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.