Using Multi Value in Zabbix Output

I am new to logstash and looking for option to send application logs to Zabbix. I was able to setup the logstash configuration with zabbix_key, but it is only getting single messages from the log and showing in Zabbix UI. Below is what i am trying to achieve.
Logstash Input:
Json message containing the log message.
application: ABC
loglevel : Error
message : SomeException

I want to output the application and Message to Zabbix. With the below setup, i was able to get only the message, but not the application.

filter {
mutate {
add_field => {
"host" => "hostname"
"zabbix_key" => "message"
output {
if [loglevel] == "ERROR" {
zabbix {
zabbix_host => "host"
zabbix_server_host => "zabbix_host"
zabbix_key => "zabbix_key"

I am thinking that i need to use multip_value. If that is the correct statement, could you let me know how it needs to be configured. Also, for multi_value, what it the Zabbix Item Key in the Zabbix UI?

Thanks in advance.


You have to define it as an array. zabbix_host and zabbix_server must still be defined, but with multi_value, you have an array of [key1, value1, key2, value2, ... keyN, valueN]. See the documentation for multi_value for this reference.

In this case, key1 must be a logstash field name referencing a zabbix item key, and value1 must be a logstash field name referencing the value to be sent to the zabbix item key referenced by key1. Repeat for all keys and values needed.

Hi Aaron,
Thanks for your reply. I watched your YouTube video on Zabbix and started using it.

So, are you saying that we need to create multiple items in Zabbix to support each zabbix_key field in the array? correct me if i misunderstood.


Anything you want to send to Zabbix must already have a corresponding key in that host created in Zabbix. Logstash will not create items in hosts in Zabbix for you.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.