hi all I am using jmx plugin to ship WebLogic MBean into ELK. for this purpose, following script is using in logstash.
input {
jmx {
path => "C:\logstash\jmxconf"
polling_frequency => 5
type => "jmx"
nb_thread => 4
}
}
filter {
mutate {
split => ["metric_path", "."]
add_field => { "jmx_path" => "%{metric_path[1]}" }
add_field => { "jmx_att1" => "%{metric_path[2]}" }
add_field => { "jmx_att2" => "%{metric_path[3]}" }
add_field => { "jmx_alias" => "%{metric_path[0]}" }
}
if "Memory" in [jmx_path]{
mutate {
add_field => { "jmx_att3" => "%{jmx_att1}_%{jmx_att2}" }
}
}
else {
mutate {
add_field => { "jmx_att3" => "%{jmx_att1}" }
}
}
aggregate {
task_id => "%{jmx_alias}"
code => "
map['jmx_alias'] = event.get('jmx_alias')
map['info'] ||= []
map['info'] << {event.get('jmx_att3') => event.get('metric_value_number')}
event.cancel()
"
push_previous_map_as_event => true
timeout => 4
}
}
output {
elasticsearch {
hosts => ["localhost:9200"]
index => "test_%{+YYYY.MM.dd}"
}
stdout { codec => rubydebug }
}
and in the "C:\logstash\jmxconf" directory, following scripts (aliases) exists:
1-
{
"host" : "1.0.0.1",
"port" : 8888,
"alias" : "srv1",
"queries" : [
{
"object_name" : "java.lang:type=Memory",
"attributes" : [ "HeapMemoryUsage", "NonHeapMemoryUsage" ],
"object_alias" : "Memory"
},{
"object_name" : "java.lang:type=Threading",
"attributes" : [ "ThreadCount", "TotalStartedThreadCount","DaemonThreadCount","PeakThreadCount" ],
"object_alias" : "Threading"
},{
"object_name" : "com.bea:ServerRuntime=MS1,Name=ThreadPoolRuntime,Type=ThreadPoolRuntime",
"attributes" : [ "StuckThreadCount", "Throughput", "QueueLength", "HoggingThreadCount", "StandbyThreadCount" ],
"object_alias" : "ThreadPoolRuntime"
},{
"object_name" : "com.bea:ServerRuntime=MS1,Name=MS1,Type=JVMRuntime",
"attributes" : [ "HeapFreePercent" ],
"object_alias" : "Heap"
}]
}
2-
{
"host" : "1.0.0.2",
"port" : 8888,
"alias" : "srv2",
"queries" : [
{
"object_name" : "java.lang:type=Memory",
"attributes" : [ "HeapMemoryUsage", "NonHeapMemoryUsage" ],
"object_alias" : "Memory"
},{
"object_name" : "java.lang:type=Threading",
"attributes" : [ "ThreadCount", "TotalStartedThreadCount","DaemonThreadCount","PeakThreadCount" ],
"object_alias" : "Threading"
},{
"object_name" : "com.bea:ServerRuntime=MS1,Name=ThreadPoolRuntime,Type=ThreadPoolRuntime",
"attributes" : [ "StuckThreadCount", "Throughput", "QueueLength", "HoggingThreadCount", "StandbyThreadCount" ],
"object_alias" : "ThreadPoolRuntime"
},{
"object_name" : "com.bea:ServerRuntime=MS1,Name=MS1,Type=JVMRuntime",
"attributes" : [ "HeapFreePercent" ],
"object_alias" : "Heap"
}]
}
it is noted without aggregation filter, each alias are collecting its each attribute as a separate event in elasticsearch; to handle this issue, i used aggregate filter in the case of using just one alias and it collects multi attributes in one event properly. but, when i am defining two aliases, it cannot collect attributes of each alias in one event correctly.