Sending [tags] to zabbix_value

[CasMeiron (Paulo Reis)]

Hello,

I'm tryin' to send the field "[tags]" to zabbix using the field but I'm unable to do that. It seems the plugin doesn't accept array because all of my other fields works when I send to zabbix.

I could try to use a ruby code to convert that (joining with ",") but if my output to elastic fails, I need to send to zabbix what happened and that's inside [tags] so I would have to use ruby inside the output which I don't think it's possible, right?

Btw, Is there a way to get the the error message (not only the tag) to send to zabbix?
Like this error:

WARN ][logstash.filters.json ] Error parsing json {:source=>"message", :raw=>"EFFEFE", :exception=>#<LogStash::Json::ParserError: Unrecognized token 'EFFEFE': was expecting ('true', 'false' or 'null')

Here's a snippet of my config:

input {
    mqtt {
		topic           => "a"
		host            => "${MQTT_HOST}"
		username        => "${MQTT_USERNAME}"
		password        => "${MQTT_PASSWORD}"
		client_id       => "b"
		clean_session   => false
		qos             => 1
  	}
}

filter {
    mutate {        
        copy => {
            "message"                   => "[@metadata][original_message]"
        }

        add_field => { 
            "zabbix_host_json_error"    => "error-json-host"
        }        
    }

    mutate {
        add_field => { 
            "zabbix_message"    => "message"
            "zabbix_error"      => "error"
            "zabbix_type"       => "type"
            "zabbix_ping"       => "ping"
        }
    }

	json {
	    source    => "message"
	}

    mutate {
        add_field => { 
            "zabbix_host"       => "[app_id]"
        }        
    }

    date {
        match   => [ "[datetime]", "yyyy-MM-dd'T'HH:mm:ss.SSSZ" ]
        target  => "[event_date]"
    }

    if ![tags] {
        mutate {
            rename => {
                "[appId]"           => "[app_id]"
                "[startupTime]"     => "[startup_time]"
                "[freeMemory]"      => "[free_memory]"
                "[totalMemory]"     => "[total_memory]"
                "[maxMemory]"       => "[max_memory]"
            }

            remove_field => [
                "topic", 
                "host",
                "@version",
                "[datetime]"            
            ]        
        }

        fingerprint {
            source => "message"
            target => "[@metadata][fingerprint]"
            method => "MURMUR3"
        }

        mutate {
            remove_field => [
                "message"
            ]
        }    
    }
}

output {
    if ![tags] {
        # if everything worked as expected, send to elastic
        elasticsearch {
            hosts           => "${ES_HOSTS}"
            doc_as_upsert   => true
            document_id     => "%{[@metadata][fingerprint]}"
            index           => "idx"
        }    
    }

    if [tags] {
        if("_jsonparsefailure" in [tags]) {
            # if json parser failed, send to a generic host
            zabbix {
                id                  => "json-error"
                zabbix_server_host  => "${ZABBIX_SERVER_HOST}"
                zabbix_server_port  => "${ZABBIX_SERVER_PORT}"
                zabbix_host         => "zabbix_host_json_error"
                multi_value         => ["zabbix_message", "[@metadata][original_message]", "zabbix_error", "tags", "zabbix_type", "zabbix_ping"]
            }   
        } else {
            # call zabbix for other errors!
            zabbix {
                id                  => "ping-default-error"
                zabbix_server_host  => "${ZABBIX_SERVER_HOST}"
                zabbix_server_port  => "${ZABBIX_SERVER_PORT}"
                zabbix_host         => "zabbix_host"
                multi_value         => ["zabbix_message", "[@metadata][original_message]", "zabbix_error", "tags", "zabbix_type", "zabbix_ping"]
            }   
        }     
    }
}

I appreciate any kind of help.

Thanks.