Logstash zabbix 插件

zabbix 監控 logstash

安裝社區擴展包
wget http://download.elasticsearch.org/logstash/logstash/logstash-contrib-1.4.2.tar.gz
解壓后覆蓋 /usr/local/logstash-1.4.2/

 

配置Zabbix監控host

創建一個組

創建監控的主機

配置需要監控的主機參數

新建應用

新建監控項

配置監控項

查看主機狀態

查看監控項狀態

測試sender

登陸客戶端(已安裝完agent)

/usr/local/zabbix-2.2.2/bin/zabbix_sender -z 192.168.124.132 -vv -s "Zabbix client" -k key.log.error -o "hello word"

-z (zabbix server address)

-vv (詳細信息)

-s (被監控的主機名)

-k (item 項名稱)

-o (發送內容)

 

查看Zabbix Server 接收到的信息

 測試已成功，可以配置 logstash.conf

 

logstash 客戶端配置文件

input {
  file {
    #定義一個標示
    type => "zabbix_log" 
    path => [ "/var/log/zabbix.test.log"]
    start_position => beginning
  }
}

filter {
   grep {
     #過濾指定標示
     type => "zabbix_log"
     match => [ "message", "(error|ERROR|CRITICAL)" ]
     #選擇標示為"zabbix-sender"的事件處理
     add_tag => [ "zabbix-sender" ]
     add_field => [
　　　　#配置主機和監控項
       "zabbix_host", "Zabbix client",
       "zabbix_item", "key.log.error"
     ]
  }
}

output {
  redis{
    host =>"192.168.124.128"
    data_type => "list"
    key => "logstash"
  }
  
  stdout {
    codec => rubydebug
  }
  
  zabbix {
    # only process events with this tag
    tags => "zabbix-sender"

    # specify the hostname or ip of your zabbix server
    # (defaults to localhost)
    host => "192.168.124.132"

    # specify the port to connect to (default 10051)
    port => "10051"

    # specify the path to zabbix_sender
    # (defaults to "/usr/local/bin/zabbix_sender")
    zabbix_sender => "/usr/local/zabbix-2.2.2/bin/zabbix_sender"
  }
}

測試：

echo "error：test zabbix">>/var/log/zabbix.test.log

這樣logstash 使用 zabbix 插件算是通了