Work with output and metrics

Elastic Stack Logstash
1

Hi,

I'm working with metrics.
Here's my code, which in meter i use the hostname to isolate metrics.

metrics {
meter => [ "%{host}" ]
flush_interval => 60
clear_interval => 300
}

In kibana i'm able to see the metric variables not in the output (email).

In my output i check the metric with this statement:

[%{host}][count]

When i receive an e-mail i've got something like [hostname][count] but not the content.
I tried %{[%{host}][count]}

No idea what i'm doing wrong.

Thanks in advance

2

Hi,

I am not sure if it is possible to make such dynamic nested hash access. I cannot found the way too.

But one possible solution could lead through using the ruby filter.

input {
  generator {
    type => "generated"
  }
}

filter {
  # make up the host_name value
  mutate {
    add_field => {
      "host_name" => "localhost"
    }
  }

  metrics {
    meter => [ "%{host_name}" ]
    flush_interval => 60
    clear_interval => 300
    # mark the metric event
    add_tag => "metric"  
  }

  if "metric" in [tags] {
  
    # the metric event starts just after the metrics filter
    #the host_name field should be put there back manually
    mutate {
      add_field => {
        "host_name" => "localhost"
      }
    }

    ruby {
      code => "event['host_count'] = event[event['host_name']]['count']"
    }
  }
}

output {
  if "metric" in [tags] {
    stdout {
      codec => line {
        format => "rate %{host_name}: %{host_count}"
      }
    }
  }
}

I am not sure how do you fill the host field, actually I had problems when using such variable name thus I used host_name and I am filling it statically .

3

Hello,

It hasn't worked for me.
I get the host variable from each server. I get it from the message.

Any other ideas why i'm not getting the metric in output configuration?

Thanks

4

That's a pity it didn't help.

I would rather avoid the host variable name, still not sure about the reason, but my example with such name does not work.

The host variable value has to be reintroduced for the metric event, the metric event starts just after the metric filter.

5

Hi terramexx,

Thanks for your solution, but doesn't work.
I don't know why is not working, my solution. It worked for other filter, but not metrics.
my meter is %{host}. In kibana i can see the metrics, it seems to work properly. However, in output filter, it doesn't work, i use [%{host}][count] and i get something like server1[count].

Any ideas?

Thanks