[Zabbix output plugin] zabbix_key is missing


I'm trying to parse a log-file with Logstash (1.5.0) and send output to Zabbix. Unfortunately, I'm receiving the following error:

←[33mSkipping zabbix output; field referenced by quik.exp is missing {:level=>:warn}←[0m

   "message" => "E: 08 Jun 15 (Mon) 13:09:28.966 (3028:1488:NegDeal): Running C:\\QUIK\\ExportQ\\Export.exe: Error: Error process NegTrade\r",
  "@version" => "1",
"@timestamp" => "2015-06-08T09:09:29.857Z",
      "type" => "QUIKExporter-log",
      "host" => "VS-MSK11-EXP02",
      "path" => "C:\\QUIK\\ExportQ\\export.log"

My logstash.conf is below:

input {
   file {
      path => ["C:\QUIK\ExportQ\export.log"]
      type => "QUIKExporter-log"
      codec => plain { charset => "CP1251" }
      start_position => "beginning"
      sincedb_path => "C:\Progra~1\logstash\sincedb"

filter {
   if [message] !~ /Error|Critical/ {
   drop { }

output {
   stdout { codec => rubydebug }
   zabbix {
	zabbix_host => "host"
	zabbix_key => "quik.exp"
	zabbix_server_host => ""
	zabbix_value => "message"

On Zabbix server ( I've added:

  • host (VS-MSK11-EXP02)
  • Item "quik.exp" for this host

Could you please advise how to resolve this issue?

Thanks in advance!

The zabbix_key needs to point to a field name that contains the item name you wish to use. That's why the error is telling you that there was no field "quik.exp"

If that value never appears in a field for you, you can always "fake" one with the mutate add_field, and put it into the new (1.5 only) @metadata field.

mutate {
  add_field => { "[@metadata][zabbix_key]" => "quik.exp" }

Then your Zabbix output would have

zabbix_key => "[@metadata][zabbix_key]" 

Forgive me if either or both of these require the sprintf syntax, e.g. "%{[@metadata][zabbix_key]}". I never remember which syntax it requires and am too busy to test it at the moment. If I were to guess, the latter might require the sprintf syntax, but not the former.

1 Like