Hello,
I am currently querying an API that returns information as follows (this is an example). The result is like plaintext string
Host: ELKDATA01 # Event Failed: check-disk-usage # Status: 1
Host: ELKDATA02 # Event Failed: check-disk-usage # Status: 1
Host: ELKDATA03 # Event Failed: check-disk-usage # Status: 1
In Zabbix I have the nodes ELKDATA01, ELKDATA02, ELKDATA03 registered, however and although I could launch a query to the API from all nodes, I think it is better that a node launches it (eg Zabbix Server) and from the other nodes to be able to parse the information.
I had thought of a calculated item that with a REGEX would return me if the API has returned that error or not. 1 o 0.
regexp("ZABBIX-SERVER:api_result",REGEX_PATTERN,500)
To then be able to by means of a macro (with the error) and a trigger to indicate if the node is giving the error of that type. If in the regexp I indicate the text without using a macro, it works, but then it only works for 1 node (since the name is hardcoded)
regexp("ZABBIX-SERVER:api_result",Host: ELKDATA01 # Event Failed: check-disk-usage # Status: 1,500)
My idea would be either to be able to indicate
regexp("ZABBIX-SERVER:api_result",Host: {HOST.NAME} # Event Failed: check-disk-usage # Status: 1,500)
or at least be able to create a macro on the host
regexp("ZABBIX-SERVER:api_result",Host: {$MYMACRO.NODE.NAME} # Event Failed: check-disk-usage # Status: 1,500)
But with these last two configurations it doesn't work for me.
I have an example of another user who, for the same server, has made use of
regexp("ZABBIX-SERVER:api_result",{$MYMACRO.NODE.NAME},500)
and when the error appears, in the host item appears the value 1. Therefore the trigger appears in Zabbix. However, this form does not interest me, since it only tells me if the node has errors, but not which one.
I would like to be able to create 1 item for each type of error. The errors that the API usually tells me are like this.
Host: ELKDATA01 # Event Failed: check-es-cluster-health # Status: 1
Host: ELKDATA01 # Event Failed: check-es-node-status # Status: 2
Host: ELKDATA02 # Event Failed: check-es-cluster-health # Status: 1
Host: ELKDATA02 # Event Failed: check-es-node-status # Status: 2
Host: ELKDATA03 # Event Failed: check-es-cluster-health # Status: 1
Host: ELKDATA03 # Event Failed: check-es-node-status # Status: 2
Host: SENSU03 # Event Failed: check-disk-usage # Status: 1
In this case (zabbix from work), the version we use is 5.0.4 LTS
I am currently querying an API that returns information as follows (this is an example). The result is like plaintext string
Host: ELKDATA01 # Event Failed: check-disk-usage # Status: 1
Host: ELKDATA02 # Event Failed: check-disk-usage # Status: 1
Host: ELKDATA03 # Event Failed: check-disk-usage # Status: 1
In Zabbix I have the nodes ELKDATA01, ELKDATA02, ELKDATA03 registered, however and although I could launch a query to the API from all nodes, I think it is better that a node launches it (eg Zabbix Server) and from the other nodes to be able to parse the information.
I had thought of a calculated item that with a REGEX would return me if the API has returned that error or not. 1 o 0.
regexp("ZABBIX-SERVER:api_result",REGEX_PATTERN,500)
To then be able to by means of a macro (with the error) and a trigger to indicate if the node is giving the error of that type. If in the regexp I indicate the text without using a macro, it works, but then it only works for 1 node (since the name is hardcoded)
regexp("ZABBIX-SERVER:api_result",Host: ELKDATA01 # Event Failed: check-disk-usage # Status: 1,500)
My idea would be either to be able to indicate
regexp("ZABBIX-SERVER:api_result",Host: {HOST.NAME} # Event Failed: check-disk-usage # Status: 1,500)
or at least be able to create a macro on the host
regexp("ZABBIX-SERVER:api_result",Host: {$MYMACRO.NODE.NAME} # Event Failed: check-disk-usage # Status: 1,500)
But with these last two configurations it doesn't work for me.
I have an example of another user who, for the same server, has made use of
regexp("ZABBIX-SERVER:api_result",{$MYMACRO.NODE.NAME},500)
and when the error appears, in the host item appears the value 1. Therefore the trigger appears in Zabbix. However, this form does not interest me, since it only tells me if the node has errors, but not which one.
I would like to be able to create 1 item for each type of error. The errors that the API usually tells me are like this.
Host: ELKDATA01 # Event Failed: check-es-cluster-health # Status: 1
Host: ELKDATA01 # Event Failed: check-es-node-status # Status: 2
Host: ELKDATA02 # Event Failed: check-es-cluster-health # Status: 1
Host: ELKDATA02 # Event Failed: check-es-node-status # Status: 2
Host: ELKDATA03 # Event Failed: check-es-cluster-health # Status: 1
Host: ELKDATA03 # Event Failed: check-es-node-status # Status: 2
Host: SENSU03 # Event Failed: check-disk-usage # Status: 1
In this case (zabbix from work), the version we use is 5.0.4 LTS
Comment