Presentation for Icinga Camp Amsterdam 2017 about monitoring logstash input with the icinga plugin for logstash

4. Output

6. filebeat.prospectors:
- input_type: log
paths:
- /var/log/backup.log
output.logstash:
hosts: ["localhost:5044"]

7. # /etc/logstash/conf.d/logstash.conf
input {
<..some inputs here (see
https://www.elastic.co/guide/en/logstash/current/input-p
lugins.html) ..>
}
filter {
<..some filters here (see
https://www.elastic.co/guide/en/logstash/current/filter-
plugins.html)..>
}
output {
<..some outputs here (see
https://www.elastic.co/guide/en/logstash/current/output-
plugins.html)..>
}

8. What are logstash plugins?
Why a logstash icinga output plugin?
Where to find the plugin?
https://github.com/Icinga/logstash-output-icinga/
Actions the plugin can take:
Action Description
process-check-result Process a check result
send-custom-notification Send a custom notification
add-comment Add a comment from an author.
remove-comment Remove all comments created by a certain author.
schedule-downtime Schedule a downtime for a host or service.
remove-downtime Remove all downtimes created by a certain author.

9. # clone the repo
git clone https://github.com/icinga/logstash-output-icinga.git
cd logstash-output-icinga/
# build the gem
[root@icinga2-elastic logstash-output-icinga]# gem build
logstash-output-icinga.gemspec
WARNING: no description specified
Successfully built RubyGem
Name: logstash-output-icinga
Version: 1.0.0
File: logstash-output-icinga-1.0.0.gem
# install the plugin
[root@icinga2-elastic bin]# ./logstash-plugin install --local
~/logstash-output-icinga/logstash-output-icinga-1.0.0.gem
Validating /root/logstash-output-icinga/logstash-output-icinga-1.0.0.gem
Installing logstash-output-icinga
Installation successful

10. object Host "my-server1" {
address = "10.0.0.1"
check_command = "hostalive"
}
object Service "ping4" {
host_name = "my-server1"
check_command = "ping4"
}
object Service "http" {
host_name = "my-server1"
check_command = "http"
}

11. object ApiUser "icinga" {
password = "icinga"
client_cn = NodeName
permissions = [ "*" ]
}
apply Service "backup" {
import "generic-service"
check_command = "dummy"
assign where host.address
}

12. input {
beats {
port => 5044
type => "logs"
}
}
filter {
if [syslog_severity] == "error" {
mutate {
replace => { "exit_status" => "2" }
}
}
}
filter {
if [source] ==
"/var/log/mypreciouslog.json" {
json {
source => "message"
}
}
}
output {
icinga {
host => 'localhost'
user => 'icinga'
password => 'icinga'
ssl_verify => false
action => 'process-check-result'
action_config => {
exit_status => "%{exit_status}"
plugin_output => "%{message}"
}
icinga_host => "%{hostname}"
icinga_service => "backup"
}
elasticsearch {
hosts => [ "localhost:9200" ]
}
stdout {
}
}