Coder Social home page Coder Social logo

logstash-output-icinga's People

Contributors

bobapple avatar colinsurprenant avatar jsvd avatar robbavey avatar yaauie avatar

Stargazers

avatar avatar

Watchers

avatar avatar avatar avatar avatar avatar avatar avatar avatar

Forkers

isabella232

logstash-output-icinga's Issues

schedule downtime for host and all services

Hi,

i´m having trouble with the child_options for scheduled downtimes.

workaround:
adding 'all_services' => {} in icinga.rb (line 275) after child_options fixed my issue, 'child_options' breaks with standard error.

i guess it´s an api problem but maybe you could an all_services to icinga.rb, as fallback key

process-check-result Error: broken pipe

Hi,

im trying to modify a check-result with logstash.
I have a Host with filebeat, that is sending new logfile entries to Logstash on another host.
That works perfectly fine.

Now I want to filter the incoming message from filebeat and output it to icinga.
But I get the following message when Logstash tries to send the data to icinga:

[WARN ][logstash.outputs.icinga ] Request failed {:host=>"localhost", :port=>5665, :path=>"/v1/actions/process-check-result?service=linArpalertVM%21testService", :body=>"{\"exit_status\":\"1\",\"plugin_output\":\"Placeholder\"}",  :error=>#<IOError: Broken pipe>}

my Icinga api_users.conf config is:

object ApiUser "root" {
  password = "password"
  //client_cn = ""
  permissions = [ "*" ]
}

object ApiUser "icinga" {
  password = "icinga"
  //client_cn = ""
  permissions = [ "*" ]
}

apply Service "testService" {
  import "generic-service"
  check_command = "dummy"
 assign where host.address
}

and my Logstash config looks like the following:

input {
  beats {
    port => 5044
    type => "logs"
  }
}

filter {
  if "new_mac" in [message] {
    mutate {
      replace => { "exit_status" => "2" }
    }
  }
}

output {
  icinga {
    host => 'localhost'
    user => 'icinga'
    password => 'icinga'
    ssl_verify => false
    action => 'process-check-result'
    action_config => {
      exit_status => "%{exit_status}"
      plugin_output => "Placeholder"
    }
    icinga_host => "linArpalertVM"
    icinga_service => "testService"
  }
  stdout { }
}

The command works fine when I enter it manually with curl:

curl -k -u icinga:icinga -H 'Accept: application/json' -X POST 'https://localhost:5665/v1/actions/process-check-result?service=linArpalertVM%21testService' -d "{\"exit_status\":\"1\",\"plugin_output\":\"Placeholder\"}"

If you need any more file content let me now...

I searched almost a week now in the internet but nothing helped...

Possible incompatibility with 6.7.1

Moved from Icinga/logstash-output-icinga#11

Hi,

We got the output working with Logstash 6.4 but not with 6.7.1. Could you please check if there's some incompatibility between the output und Logstash 6.7.1?

Here are the error messages:

[2019-04-10T18:12:23,808][ERROR][logstash.agent           ] Failed to execute action {:action=>LogStash::PipelineAction::Reload/pipeline_id:oracle, :exception=>"SyntaxError", :message=>"/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-icinga-1.2.1/lib/logstash/outputs/icinga.rb:383: Invalid next", :backtrace=>["org/jruby/RubyClass.java:233:in `allocate'", "org/logstash/config/ir/compiler/OutputStrategyExt.java:232:in `initialize'", "org/logstash/config/ir/compiler/OutputDelegatorExt.java:48:in `initialize'", "org/logstash/config/ir/compiler/OutputDelegatorExt.java:30:in `initialize'", "org/logstash/plugins/PluginFactoryExt.java:239:in `plugin'", "org/logstash/plugins/PluginFactoryExt.java:184:in `plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:71:in `plugin'", "(eval):147:in `initialize'", "org/jruby/RubyKernel.java:1047:in `eval'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:49:in `initialize'", "/usr/share/logstash/logstash-co
 re/lib/logstash/pipeline_action/reload.rb:43:in `block in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:96:in `block in exclusive'", "org/jruby/ext/thread/Mutex.java:165:in `synchronize'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:96:in `exclusive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/reload.rb:39:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:334:in `block in converge_state'"]}

'No object found' when space in object names

I've encountered a problem sending check results to services when the service contains a "space" in its name.

Expected Behavior

The service should receive the passive check results

Current Behavior

Error is returned:

Response: {:response_code=>"404", :response_body=>"{"error":404.0,"status":"No objects found."}"}

Possible Solution

As a quick fix, I managed to get the check result processed by changing "../lib/logstash/outputs/icinga.rb" , around line 315.

Change

@uri.query = URI.encode_www_form({:service => "#{icinga_host}!#{icinga_service}"})
          else
@uri.query = URI.encode_www_form({:host => icinga_host})

to

@uri.query = URI.encode_www_form({:service => "#{icinga_host}!#{icinga_service}"}).gsub('+','%20')
          else
@uri.query = URI.encode_www_form({:host => icinga_host}).gsub('+','%20')

(uses %20 url encode for space instead of plus sign)

Steps to Reproduce (for bugs)

  1. Setup a service to accept passive check results in Icinga, with a space in the name (like "Test Passive")
  2. Configured the icinga output in Logstash following the general example given, with..
    ...
    action => "process-check-result"
    icinga_service => "Test Passive"
    ...
  3. send input to the Logstash pipe
  4. check logs and service in Icinga2 monitor

Context

Your Environment

  • Plugin version (bin/logstash-plugin list '*icinga*'): 1.2.2
  • Logstash version (bin/logstash -V): 6.8.0
  • Icinga 2 version (icinga2 --version): 2.10.5
  • Ruby version (ruby -V):
  • Operating System and version: Centos 7

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.