Zabbix output to logstash

Elastic Stack Logstash
1

Hi,

we have multiple node servers that are connecting with master server through logstash.

Zabbix agent is installed on almost all nodes.

Can i use zabbix to send data to logstash? If so, how can i do that? Is there any documentation available for this?

Regards,
Shrawan

2

NOTE: This is predicated on my now somewhat outdated Zabbix 2.x knowledge.

No. Not yet, anyway. There is no clear mechanism to get data from Zabbix into Logstash.

To accomplish this today, one of these approaches might work:

  1. Logstash would have to appear to be a Zabbix server
  2. You would have to query the backend database for Zabbix
  3. You would have to use the Zabbix API to query for the results.

#1 is perhaps the most potentially performant, but requires some ingenuity and coding skill to basically rewrite the listener portion of the Zabbix server. I'm not even sure it could be cleanly mapped, as Zabbix has both passive and active items, and the agent may not even be able to send the correct things to Logstash for one or the other.

#2 This is potentially doable, but the database schema has so many table joins to collect and match host names & item names, and then match the associated ids with data in the history table, that it would be very complex queries indeed. It would be done via the Logstash jdbc input plugin, and also requires a considerable amount of domain knowledge of the Zabbix database schema.

#3 The Zabbix API could be used to do the data collection. But as with the database schema approach, it requires that you know what you're trying to load, and the PHP API is not terribly fast or reliable (in my experience).

Zabbix 3.x may provide a way to stream the data out as it comes in. If so, I haven't heard of it yet. If it does, though, then it could be read by Logstash just like any other data stream.

1 Like
3

For custom items, you might be able to use Zabbix user parameters + netcat + TCP input.

I have not personally done this with Logstash, but have for other TCP listeners. (note the results will still come back to the Zabbix server, but provides a means to hook into template'd items )

Example config:

UnsafeUserParameters=1
UserParameter=myitem[*],echo -n "[myitem] [$1] [$2] [$3] [$4]" | nc localhost tcp_port

1 Like
4

Good call, @jakelandis. If you only need a subset of the data, and it's all in UserParameters this approach would work.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.