# Using Multi Value in Zabbix Output

**URL:** <https://discuss.elastic.co/t/using-multi-value-in-zabbix-output/69707>\
**Category:** Logstash\
**Created:** [December 21, 2016, 8:24pm UTC](https://discuss.elastic.co/t/using-multi-value-in-zabbix-output/69707 "2016-12-21T20:24:36Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![singu](https://avatars.discourse-cdn.com/v4/letter/s/57b2e6/32.png) [@singu](https://discuss.elastic.co/u/singu)\
**Post date:** [December 21, 2016, 8:24pm UTC](https://discuss.elastic.co/t/using-multi-value-in-zabbix-output/69707/1 "2016-12-21T20:24:36Z")

</div>

Hi,  
I am new to logstash and looking for option to send application logs to Zabbix. I was able to setup the logstash configuration with zabbix\_key, but it is only getting single messages from the log and showing in Zabbix UI. Below is what i am trying to achieve.  
Logstash Input:  
Json message containing the log message.  
Ex:  
{  
application: ABC  
loglevel : Error  
message : SomeException  
}

I want to output the application and Message to Zabbix. With the below setup, i was able to get only the message, but not the application.

filter {  
mutate {  
add\_field =\> {  
"host" =\> "hostname"  
"zabbix\_key" =\> "message"  
}  
}  
}  
output {  
if [loglevel] == "ERROR" {  
zabbix {  
zabbix\_host =\> "host"  
zabbix\_server\_host =\> "zabbix\_host"  
zabbix\_key =\> "zabbix\_key"  
}  
}  
}

I am thinking that i need to use multip\_value. If that is the correct statement, could you let me know how it needs to be configured. Also, for multi\_value, what it the Zabbix Item Key in the Zabbix UI?

Thanks in advance.

Regards,  
Singu.

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [December 21, 2016, 8:43pm UTC](https://discuss.elastic.co/t/using-multi-value-in-zabbix-output/69707/2 "2016-12-21T20:43:35Z")

</div>

You have to define it as an array. `zabbix_host` and `zabbix_server` must still be defined, but with `multi_value`, you have an array of `[key1, value1, key2, value2, ... keyN, valueN]`. See [the documentation for multi\_value](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-zabbix.html#plugins-outputs-zabbix-multi_value) for this reference.

In this case, `key1` must be a logstash field name referencing a zabbix item key, and `value1` must be a logstash field name referencing the value to be sent to the zabbix item key referenced by `key1`. Repeat for all keys and values needed.

---

<div class="post-metadata">

**Author:** ![singu](https://avatars.discourse-cdn.com/v4/letter/s/57b2e6/32.png) [@singu](https://discuss.elastic.co/u/singu)\
**Post date:** [December 21, 2016, 9:06pm UTC](https://discuss.elastic.co/t/using-multi-value-in-zabbix-output/69707/3 "2016-12-21T21:06:29Z")

</div>

Hi Aaron,  
Thanks for your reply. I watched your YouTube video on Zabbix and started using it.

So, are you saying that we need to create multiple items in Zabbix to support each zabbix\_key field in the array? correct me if i misunderstood.

Thanks,  
Singaiah.

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [December 21, 2016, 9:26pm UTC](https://discuss.elastic.co/t/using-multi-value-in-zabbix-output/69707/4 "2016-12-21T21:26:16Z")

</div>

Anything you want to send to Zabbix must already have a corresponding key in that host created in Zabbix. Logstash will not create items in hosts in Zabbix for you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 18, 2017, 9:26pm UTC](https://discuss.elastic.co/t/using-multi-value-in-zabbix-output/69707/5 "2017-01-18T21:26:35Z")

</div>

Closed on January 18, 2017, 9:26pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.