# \[Zabbix output plugin\] zabbix\_key is missing

**URL:** <https://discuss.elastic.co/t/zabbix-output-plugin-zabbix-key-is-missing/2123>\
**Category:** Logstash\
**Created:** [June 8, 2015, 9:14am UTC](https://discuss.elastic.co/t/zabbix-output-plugin-zabbix-key-is-missing/2123 "2015-06-08T09:14:41Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![MrAV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mrav/32/557_2.png) [@MrAV](https://discuss.elastic.co/u/MrAV)\
**Post date:** [June 8, 2015, 9:14am UTC](https://discuss.elastic.co/t/zabbix-output-plugin-zabbix-key-is-missing/2123/1 "2015-06-08T09:14:41Z")

</div>

Hi,

I'm trying to parse a log-file with Logstash (1.5.0) and send output to Zabbix. Unfortunately, I'm receiving the following error:

```
←[33mSkipping zabbix output; field referenced by quik.exp is missing {:level=>:warn}←[0m

{
   "message" => "E: 08 Jun 15 (Mon) 13:09:28.966 (3028:1488:NegDeal): Running C:\\QUIK\\ExportQ\\Export.exe: Error: Error process NegTrade\r",
  "@version" => "1",
"@timestamp" => "2015-06-08T09:09:29.857Z",
      "type" => "QUIKExporter-log",
      "host" => "VS-MSK11-EXP02",
      "path" => "C:\\QUIK\\ExportQ\\export.log"

```

My logstash.conf is below:

```
input {
   file {
      path => ["C:\QUIK\ExportQ\export.log"]
      type => "QUIKExporter-log"
      codec => plain { charset => "CP1251" }
      start_position => "beginning"
      sincedb_path => "C:\Progra~1\logstash\sincedb"
   }
}

filter {
   if [message] !~ /Error|Critical/ {
   drop { }
}
}

output {
   stdout { codec => rubydebug }
   zabbix {
	zabbix_host => "host"
	zabbix_key => "quik.exp"
	zabbix_server_host => "10.1.110.71"
	zabbix_value => "message"
  }
}

```

On Zabbix server (10.1.110.71) I've added:

- host (VS-MSK11-EXP02)
- Item "quik.exp" for this host

Could you please advise how to resolve this issue?

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [June 8, 2015, 3:55pm UTC](https://discuss.elastic.co/t/zabbix-output-plugin-zabbix-key-is-missing/2123/2 "2015-06-08T15:55:53Z")

</div>

The zabbix\_key needs to point to a field name that contains the item name you wish to use. That's why the error is telling you that there was no field "quik.exp"

If that value never appears in a field for you, you can always "fake" one with the mutate add\_field, and put it into the new (1.5 only) @metadata field.

```
mutate {
  add_field => { "[@metadata][zabbix_key]" => "quik.exp" }
}

```

Then your Zabbix output would have

```
zabbix_key => "[@metadata][zabbix_key]" 

```

Forgive me if either or both of these require the sprintf syntax, e.g. "%{[@metadata][zabbix\_key]}". I never remember which syntax it requires and am too busy to test it at the moment. If I were to guess, the latter might require the sprintf syntax, but not the former.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:38am UTC](https://discuss.elastic.co/t/zabbix-output-plugin-zabbix-key-is-missing/2123/3 "2017-07-06T05:38:11Z")

</div>