Using Multi Value in Zabbix Output

Elastic Stack Logstash
1

Hi,
I am new to logstash and looking for option to send application logs to Zabbix. I was able to setup the logstash configuration with zabbix_key, but it is only getting single messages from the log and showing in Zabbix UI. Below is what i am trying to achieve.
Logstash Input:
Json message containing the log message.
Ex:
{
application: ABC
loglevel : Error
message : SomeException
}

I want to output the application and Message to Zabbix. With the below setup, i was able to get only the message, but not the application.

filter {
mutate {
add_field => {
"host" => "hostname"
"zabbix_key" => "message"
}
}
}
output {
if [loglevel] == "ERROR" {
zabbix {
zabbix_host => "host"
zabbix_server_host => "zabbix_host"
zabbix_key => "zabbix_key"
}
}
}

I am thinking that i need to use multip_value. If that is the correct statement, could you let me know how it needs to be configured. Also, for multi_value, what it the Zabbix Item Key in the Zabbix UI?

Thanks in advance.

Regards,
Singu.

2

You have to define it as an array. zabbix_host and zabbix_server must still be defined, but with multi_value, you have an array of [key1, value1, key2, value2, ... keyN, valueN]. See the documentation for multi_value for this reference.

In this case, key1 must be a logstash field name referencing a zabbix item key, and value1 must be a logstash field name referencing the value to be sent to the zabbix item key referenced by key1. Repeat for all keys and values needed.

3

Hi Aaron,
Thanks for your reply. I watched your YouTube video on Zabbix and started using it.

So, are you saying that we need to create multiple items in Zabbix to support each zabbix_key field in the array? correct me if i misunderstood.

Thanks,
Singaiah.

4

Anything you want to send to Zabbix must already have a corresponding key in that host created in Zabbix. Logstash will not create items in hosts in Zabbix for you.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.