# Sending \[tags\] to zabbix\_value

**URL:** <https://discuss.elastic.co/t/sending-tags-to-zabbix-value/132387>\
**Category:** Logstash\
**Created:** [May 17, 2018, 7:19pm UTC](https://discuss.elastic.co/t/sending-tags-to-zabbix-value/132387 "2018-05-17T19:19:18Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![CasMeiron](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/casmeiron/32/24578_2.png) [@CasMeiron](https://discuss.elastic.co/u/CasMeiron)\
**Post date:** [May 17, 2018, 7:19pm UTC](https://discuss.elastic.co/t/sending-tags-to-zabbix-value/132387/1 "2018-05-17T19:19:18Z")

</div>

Hello,

I'm tryin' to send the field "[tags]" to zabbix using the field but I'm unable to do that. It seems the plugin doesn't accept array because all of my other fields works when I send to zabbix.

I could try to use a ruby code to convert that (joining with ",") but if my output to elastic fails, I need to send to zabbix what happened and that's inside [tags] so I would have to use ruby inside the output which I don't think it's possible, right?

Btw, Is there a way to get the the error message (not only the tag) to send to zabbix?  
Like this error:

`WARN ][logstash.filters.json] Error parsing json {:source=>"message", :raw=>"EFFEFE", :exception=>#<LogStash::Json::ParserError: Unrecognized token 'EFFEFE': was expecting ('true', 'false' or 'null')`

Here's a snippet of my config:

```
input {
    mqtt {
		topic => "a"
		host => "${MQTT_HOST}"
		username => "${MQTT_USERNAME}"
		password => "${MQTT_PASSWORD}"
		client_id => "b"
		clean_session => false
		qos => 1
  	}
}

filter {
    mutate {        
        copy => {
            "message" => "[@metadata][original_message]"
        }

        add_field => { 
            "zabbix_host_json_error" => "error-json-host"
        }        
    }

    mutate {
        add_field => { 
            "zabbix_message" => "message"
            "zabbix_error" => "error"
            "zabbix_type" => "type"
            "zabbix_ping" => "ping"
        }
    }

	json {
	    source => "message"
	}

    mutate {
        add_field => { 
            "zabbix_host" => "[app_id]"
        }        
    }

    date {
        match => ["[datetime]", "yyyy-MM-dd'T'HH:mm:ss.SSSZ" ]
        target => "[event_date]"
    }

    if ![tags] {
        mutate {
            rename => {
                "[appId]" => "[app_id]"
                "[startupTime]" => "[startup_time]"
                "[freeMemory]" => "[free_memory]"
                "[totalMemory]" => "[total_memory]"
                "[maxMemory]" => "[max_memory]"
            }

            remove_field => [
                "topic", 
                "host",
                "@version",
                "[datetime]"            
            ]        
        }

        fingerprint {
            source => "message"
            target => "[@metadata][fingerprint]"
            method => "MURMUR3"
        }

        mutate {
            remove_field => [
                "message"
            ]
        }    
    }
}

output {
    if ![tags] {
        # if everything worked as expected, send to elastic
        elasticsearch {
            hosts => "${ES_HOSTS}"
            doc_as_upsert => true
            document_id => "%{[@metadata][fingerprint]}"
            index => "idx"
        }    
    }

    if [tags] {
        if("_jsonparsefailure" in [tags]) {
            # if json parser failed, send to a generic host
            zabbix {
                id => "json-error"
                zabbix_server_host => "${ZABBIX_SERVER_HOST}"
                zabbix_server_port => "${ZABBIX_SERVER_PORT}"
                zabbix_host => "zabbix_host_json_error"
                multi_value => ["zabbix_message", "[@metadata][original_message]", "zabbix_error", "tags", "zabbix_type", "zabbix_ping"]
            }   
        } else {
            # call zabbix for other errors!
            zabbix {
                id => "ping-default-error"
                zabbix_server_host => "${ZABBIX_SERVER_HOST}"
                zabbix_server_port => "${ZABBIX_SERVER_PORT}"
                zabbix_host => "zabbix_host"
                multi_value => ["zabbix_message", "[@metadata][original_message]", "zabbix_error", "tags", "zabbix_type", "zabbix_ping"]
            }   
        }     
    }
}

```

I appreciate any kind of help.

Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 14, 2018, 7:19pm UTC](https://discuss.elastic.co/t/sending-tags-to-zabbix-value/132387/2 "2018-06-14T19:19:19Z")

</div>

Closed on June 14, 2018, 7:19pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.