[Zabbix output plugin] zabbix_key is missing

Elastic Stack Logstash
1

Hi,

I'm trying to parse a log-file with Logstash (1.5.0) and send output to Zabbix. Unfortunately, I'm receiving the following error:

←[33mSkipping zabbix output; field referenced by quik.exp is missing {:level=>:warn}←[0m


{
   "message" => "E: 08 Jun 15 (Mon) 13:09:28.966 (3028:1488:NegDeal): Running C:\\QUIK\\ExportQ\\Export.exe: Error: Error process NegTrade\r",
  "@version" => "1",
"@timestamp" => "2015-06-08T09:09:29.857Z",
      "type" => "QUIKExporter-log",
      "host" => "VS-MSK11-EXP02",
      "path" => "C:\\QUIK\\ExportQ\\export.log"

My logstash.conf is below:

input {
   file {
      path => ["C:\QUIK\ExportQ\export.log"]
      type => "QUIKExporter-log"
      codec => plain { charset => "CP1251" }
      start_position => "beginning"
      sincedb_path => "C:\Progra~1\logstash\sincedb"
   }
}

filter {
   if [message] !~ /Error|Critical/ {
   drop { }
}
}

output {
   stdout { codec => rubydebug }
   zabbix {
	zabbix_host => "host"
	zabbix_key => "quik.exp"
	zabbix_server_host => "10.1.110.71"
	zabbix_value => "message"
  }
}

On Zabbix server (10.1.110.71) I've added:

  • host (VS-MSK11-EXP02)
  • Item "quik.exp" for this host

Could you please advise how to resolve this issue?

Thanks in advance!

2

The zabbix_key needs to point to a field name that contains the item name you wish to use. That's why the error is telling you that there was no field "quik.exp"

If that value never appears in a field for you, you can always "fake" one with the mutate add_field, and put it into the new (1.5 only) @metadata field.

mutate {
  add_field => { "[@metadata][zabbix_key]" => "quik.exp" }
}

Then your Zabbix output would have

zabbix_key => "[@metadata][zabbix_key]"

Forgive me if either or both of these require the sprintf syntax, e.g. "%{[@metadata][zabbix_key]}". I never remember which syntax it requires and am too busy to test it at the moment. If I were to guess, the latter might require the sprintf syntax, but not the former.

1 Like