logstash-input-nagioscheck 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 8ca20ad47c778a45985808bcbf33745f7dc0161e60ff62559cc812038437b678
+  data.tar.gz: 704d48106df1f6b9da3bb900f0f9bb89fa54a59d51b61a145080a91fd7183884
+SHA512:
+  metadata.gz: fa9abb0d1c8b7b9dff9b6ed822092593646d2c562b6435e879a3af3b6c56c5d36aeabd27427759459a3ab25bff2fb535831d1a94cae84e295caa1eff02ad906e
+  data.tar.gz: c68be11d949439c24c44a2259833cb89120b6892e54d4ff1679700a5d214b6a091f9b4829869b5416e922a93bce7ea460a2a5d6fd4a7dfb91692ad3f8065a0ba

data/CHANGELOG.md

@@ -0,0 +1,2 @@
+## 0.1.0
+  - Plugin created with the logstash plugin generator

data/CONTRIBUTORS

@@ -0,0 +1,10 @@
+The following is a list of people who have contributed ideas, code, bug
+reports, or in general have helped logstash along its way.
+
+Contributors:
+*  - jay.greenberg@elastic.co
+
+Note: If you've sent us patches, bug reports, or otherwise contributed to
+Logstash, and you aren't on the list above and want to be, please let us know
+and we'll make sure you're here. Contributions from folks like you are what make
+open source awesome.

data/DEVELOPER.md

@@ -0,0 +1,2 @@
+# logstash-input-nagioscheck
+Example input plugin. This should help bootstrap your effort to write your own input plugin!

data/Gemfile

@@ -0,0 +1,3 @@
+source 'https://rubygems.org'
+gemspec
+

data/LICENSE

@@ -0,0 +1,11 @@
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

data/README.md

@@ -0,0 +1,96 @@
+# Module settings and structure
+
+## settings 
+
+### logstash.yml
+
+```
+modules:
+  - name: netflow
+  var.output.elasticsearch.host: "es.mycloud.com"
+  var.output.elasticsearch.user: "foo"
+  var.output.elasticsearch.password: "password"
+  var.input.tcp.port: 5606
+```
+
+### command-line
+
+```
+bin/logstash \
+ --modules netflow \
+ -M "netflow.var.output.elasticsearch.host=es.mycloud.com" \
+ -M "netflow.var.output.elasticsearch.user=foo" \
+ -M "netflow.var.output.elasticsearch.password=password" \
+ -M "netflow.var.input.tcp.port=5606"
+```
+
+## Current Gem structure
+```
+GEM File structure
+logstash-module-netflow
+├── configuration
+│   ├── elasticsearch
+│   │   └── netflow.json
+│   ├── kibana
+│   │   ├── dashboard
+│   │   │   └── netflow.json (contains '["dash1", "dash2"]')
+│   │   │   └── dash1.json ("panelJSON" contains refs to visualization panels 1,2 and search 1)
+│   │   │   └── dash2.json ("panelJSON" contains refs to visualization panel 3  and search 2)
+│   │   ├── index-pattern
+|   |   |   └── netflow.json
+│   │   ├── search
+|   |   |   └── search1.json
+|   |   |   └── search2.json
+│   │   └── vizualization
+|   |   |   └── panel1.json
+|   |   |   └── panel2.json
+|   |   |   └── panel3.json
+│   └── logstash
+│       └── netflow.conf.erb
+├── lib
+│   └── logstash_registry.rb
+└── logstash-module-netflow.gemspec
+```
+## Proposed multi-version Gem structure
+```
+GEM File structure
+logstash-module-netflow
+├── configuration
+│   ├── elasticsearch
+│   │   └── netflow.json
+│   ├── kibana
+│   │   ├── dashboard
+│   │   │   └── netflow.json (contains '{"v5.5.0": ["dash1", "dash2"], "v6.0.4": ["dash1", "dash2"]')
+│   │   │   └── v5.5.0
+│   │   │   |   └── dash1.json ("panelJSON" contains refs to visualization panels 1,2 and search 1)
+│   │   │   |   └── dash2.json ("panelJSON" contains refs to visualization panel 3  and search 2)
+│   │   │   └── v6.0.4
+│   │   │       └── dash1.json ("panelJSON" contains refs to visualization panels 1,2 and search 1)
+│   │   │       └── dash2.json ("panelJSON" contains refs to visualization panel 3  and search 2)
+│   │   ├── index-pattern
+│   │   │   └── v5
+|   |   |   |   └── netflow.json
+│   │   │   └── v6
+|   |   |       └── netflow.json
+│   │   ├── search
+│   │   │   └── v5
+|   |   |   |   └── search1.json
+|   |   |   |   └── search2.json
+│   │   │   └── v6
+|   |   |       └── search1.json
+|   |   |       └── search2.json
+│   │   └── vizualization
+│   │   │   └── v5
+|   |   |   |   └── panel1.json
+|   |   |   |   └── panel2.json
+|   |   |   |   └── panel3.json
+│   │   │   └── v6
+|   |   |       └── panel1.json
+|   |   |       └── panel2.json
+|   |   |       └── panel3.json
+│   └── logstash
+│       └── netflow.conf.erb
+├── lib
+│   └── logstash_registry.rb
+└── logstash-module-netflow.gemspec
+```

data/lib/logstash/inputs/nagioscheck.rb

@@ -0,0 +1,128 @@
+# encoding: utf-8
+require "logstash/inputs/exec"
+require "logstash/namespace"
+require "stud/interval"
+require "socket" # for Socket.gethostname
+require 'securerandom'
+
+# Generate a repeating message.
+#
+# This plugin is intented only as an example.
+
+class LogStash::Inputs::Nagioscheck < LogStash::Inputs::Exec
+  config_name "nagioscheck"
+
+  # Name of the check
+  config :name, :validate => :string, :required => true
+
+  # Custom parse failure tag
+  config :failure_tag, :validate => :string, :default => "_nagioscheckparsefailure"
+  
+  # Override the execute routine from the exec input
+  def execute(queue)
+    start = Time.now
+    output = exit_status = nil
+    begin
+      @logger.debug? && @logger.debug("Running exec", :command => @command)
+      output, exit_status = run_command()
+    rescue StandardError => e
+      @logger.error("Error while running command",
+        :command => @command, :e => e, :backtrace => e.backtrace)
+    rescue Exception => e
+      @logger.error("Exception while running command",
+        :command => @command, :e => e, :backtrace => e.backtrace)
+    end
+    duration = Time.now - start
+    unless exit_status.nil? #exit status will be nil if the command never completed running
+      @logger.debug? && @logger.debug("Command completed", :command => @command, :duration => duration)
+      @codec.decode(output) do |event|
+        decorate(event)
+
+        cmd_message, cmd_perf = event.get("message").split('|')
+
+        event.set("check_uuid", SecureRandom.uuid)
+
+        unless cmd_perf.nil?
+          cmd_perf.strip.split_by_spaces_except_single_quoted.each { |metric| 
+    
+              results = parse_performance(metric)
+    
+              if results.nil?
+                
+                @logger.warn("Error parsing nagios performance data (malformed)", :raw => event.get("message"))
+                event.tag(@failure_tag)
+    
+              else 
+    
+                perf_event = event.clone
+                perf_event.remove("message")
+
+                perf_event.set("type", "nagiosmetric")
+                perf_event.set("name", @name)
+                perf_event.set("label", results[1])
+                perf_event.set("uom", results[3])
+                perf_event.set("value", results[2].to_f)
+                perf_event.set("warning", results[4].to_f)
+                perf_event.set("critical", results[5].to_f)
+                perf_event.set("min", results[6].to_f)
+                perf_event.set("max", results[7].to_f)
+                
+                queue << perf_event
+    
+              end
+    
+          }
+        end
+
+        event.set("host", @hostname)
+        event.set("command", @command)
+        event.set("type", "nagioscheck")
+        event.set("message", cmd_message.nil? ? "" : cmd_message.strip)
+        event.set("name", @name)
+        event.set("took_ms", duration * 1000)
+        event.set("status_code", exit_status)
+        event.set("status", nice_status(exit_status))
+        
+        queue << event
+
+      end
+    end
+    duration
+  end
+ 
+end # class LogStash::Inputs::Nagioscheck
+
+class String
+  def split_by_spaces_except_single_quoted
+  self.split(/\s(?=(?:[^']|'[^']*')*$)/)
+  end
+end
+
+def nice_status(status) 
+	case status
+  when 0
+		return "OK"
+	when 1
+		return "WARNING"
+	when 2
+		return "CRITICAL"
+	when 3
+		return "UNKNOWN"
+  else 
+    return "INVALID STATUS"
+  end
+end
+
+
+def parse_performance(perf)
+  
+  # As per https://github.com/nagios-plugins/nagios-plugin-perl/blob/master/lib/Nagios/Monitoring/Plugin/Performance.pm
+
+  value = /[-+]?[\d\.,]+/
+  value_re = /#{value}(?:e#{value})?/
+  value_with_negative_infinity = /#{value_re}|~/
+  
+  regex = /^'?([^'=]+)'?=(#{value_re})([\w%]*);?(#{value_with_negative_infinity}\:?#{value_re}?)?;?(#{value_with_negative_infinity}\:?#{value_re}?)?;?(#{value_re})?;?(#{value_re})?/o
+  regex.match(perf)
+
+end

data/lib/logstash_registry.rb

@@ -0,0 +1,4 @@
+require "logstash/inputs/nagioscheck"
+
+LogStash::PLUGIN_REGISTRY.add(:modules, "nagios", LogStash::Modules::Scaffold.new("nagios", File.join(File.dirname(__FILE__), "..", "module")))
+LogStash::PLUGIN_REGISTRY.add(:input, "nagios", LogStash::Inputs::Nagioscheck)

data/logstash-input-nagioscheck.gemspec

@@ -0,0 +1,27 @@
+Gem::Specification.new do |s|
+  s.name          = 'logstash-input-nagioscheck'
+  s.version       = '0.1.0'
+  s.licenses      = ['Apache-2.0']
+  s.summary       = 'Logstash NagiosCheck Filter'
+  s.description   = 'Parses the output of Nagios Checks (via exec input)'
+  s.homepage      = 'http://www.elastic.co'
+  s.authors       = ['Jay Greenberg']
+  s.email         = 'jay.greenberg@elastic.co'
+  s.require_paths = ['lib']
+
+  # Files
+  s.files = Dir['lib/**/*','module/**/*','spec/**/*','vendor/**/*','*.gemspec','*.md','CONTRIBUTORS','Gemfile','LICENSE','NOTICE.TXT']
+   # Tests
+  s.test_files = s.files.grep(%r{^(test|spec|features)/})
+
+  # Special flag to let us know this is actually a logstash plugin
+  s.metadata = { "logstash_plugin" => "true", "logstash_group" => "input" }
+
+  # Gem dependencies
+  s.add_runtime_dependency "logstash-core-plugin-api", "~> 2.0"
+  s.add_runtime_dependency 'logstash-codec-plain'
+  s.add_runtime_dependency 'logstash-input-exec', ">= 3.3.0"
+  s.add_runtime_dependency 'stud', '>= 0.0.22'
+  s.add_development_dependency 'logstash-devutils', '>= 0.0.16'
+  s.add_development_dependency 'logstash-input-exec', ">= 3.3.0"
+end

data/module/elasticsearch/nagios.json

@@ -0,0 +1,99 @@
+{
+  "mappings": {
+    "doc": {
+      "_meta": {
+        "version": "6.2.0"
+      },
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "@version": {
+          "type": "keyword",
+          "ignore_above": 256
+        },
+        "check_uuid": {
+          "type": "keyword",
+          "ignore_above": 256
+        },
+        "command": {
+          "type": "text",
+          "fields": {
+            "keyword": {
+              "type": "keyword",
+              "ignore_above": 256
+            }
+          }
+        },
+        "critical": {
+          "type": "float"
+        },
+        "host": {
+          "type": "keyword",
+          "ignore_above": 256
+        },
+        "label": {
+          "type": "text",
+          "fields": {
+            "keyword": {
+              "type": "keyword",
+              "ignore_above": 256
+            }
+          }
+        },
+        "max": {
+          "type": "float"
+        },
+        "message": {
+          "type": "text",
+          "fields": {
+            "keyword": {
+              "type": "keyword",
+              "ignore_above": 256
+            }
+          }
+        },
+        "min": {
+          "type": "float"
+        },
+        "name": {
+          "type": "keyword",
+          "ignore_above": 256
+        },
+        "status": {
+          "type": "keyword",
+          "ignore_above": 256
+        },
+        "status_code": {
+          "type": "long"
+        },
+        "tags": {
+          "type": "keyword",
+          "ignore_above": 256
+        },
+        "took_ms": {
+          "type": "float"
+        },
+        "type": {
+          "type": "keyword",
+          "ignore_above": 256
+        },
+        "uom": {
+          "type": "keyword",
+          "ignore_above": 256
+        },
+        "value": {
+          "type": "float"
+        },
+        "warning": {
+          "type": "float"
+        }
+      }
+    }
+  },
+  "order": 0,
+  "settings": {
+    "index.refresh_interval": "5s"
+  },
+  "template": "nagios-*"
+}

data/module/kibana/6.x/dashboard/Nagios Overview.json

@@ -0,0 +1,13 @@
+{
+  "title": "Nagios Overview",
+  "hits": 0,
+  "description": "",
+  "panelsJSON": "[{\"panelIndex\":\"1\",\"gridData\":{\"x\":3,\"y\":0,\"w\":9,\"h\":3,\"i\":\"1\"},\"id\":\"d602cb70-52d1-11e8-8d6e-5ded8718dfbd\",\"type\":\"visualization\",\"version\":\"6.2.3\"},{\"panelIndex\":\"3\",\"gridData\":{\"x\":6,\"y\":3,\"w\":6,\"h\":3,\"i\":\"3\"},\"embeddableConfig\":{\"table\":{\"sort\":{\"column\":\"7fa9c650-52d3-11e8-a1cd-61c073d732d5\",\"order\":\"desc\"}}},\"id\":\"e1b3e380-52d3-11e8-8d6e-5ded8718dfbd\",\"type\":\"visualization\",\"version\":\"6.2.3\"},{\"panelIndex\":\"5\",\"gridData\":{\"x\":0,\"y\":0,\"w\":3,\"h\":3,\"i\":\"5\"},\"embeddableConfig\":{\"vis\":{\"colors\":{\"Critical\":\"#F29191\",\"OK\":\"#B7DBAB\",\"Warning\":\"#F4D598\"},\"legendOpen\":false}},\"id\":\"e6d01410-52d8-11e8-8d6e-5ded8718dfbd\",\"type\":\"visualization\",\"version\":\"6.2.3\"},{\"panelIndex\":\"6\",\"gridData\":{\"x\":0,\"y\":3,\"w\":6,\"h\":3,\"i\":\"6\"},\"id\":\"7b67a110-52d9-11e8-8d6e-5ded8718dfbd\",\"type\":\"visualization\",\"version\":\"6.2.3\"}]",
+  "optionsJSON": "{\"darkTheme\":false,\"hidePanelTitles\":false,\"useMargins\":true}",
+  "version": 1,
+  "timeRestore": false,
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[],\"highlightAll\":true,\"version\":true}"
+ }
+}
+   

data/module/kibana/6.x/dashboard/nagios.json

@@ -0,0 +1 @@
+["Nagios Overview"]

data/module/kibana/6.x/index-pattern/nagios.json

@@ -0,0 +1,5 @@
+{
+  "title": "nagios-*",
+  "timeFieldName": "@timestamp",
+  "fields": "[{\"name\":\"@timestamp\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"@version\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"_score\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_source\",\"type\":\"_source\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":false},{\"name\":\"check_uuid\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"command\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"command.keyword\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"critical\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"host\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"label\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"label.keyword\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"max\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"message\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"message.keyword\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"min\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"status\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"status_code\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"tags\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"took_ms\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"uom\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"value\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true},{\"name\":\"warning\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":true,\"aggregatable\":true,\"readFromDocValues\":true}]"
+}

data/module/kibana/6.x/visualization/7b67a110-52d9-11e8-8d6e-5ded8718dfbd.json

@@ -0,0 +1,10 @@
+{
+    "title": "Status Overview By Host",
+    "visState": "{\"title\":\"Status Overview By Host\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"table\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"filters\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\",\"field\":\"name\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"bar\",\"line_width\":\"0\",\"point_size\":1,\"fill\":\"0.5\",\"stacked\":\"stacked\",\"terms_field\":\"label.keyword\",\"label\":\"OK\",\"filter\":\"status:OK\",\"split_filters\":[{\"filter\":\"status: OK\",\"label\":\"OK\",\"color\":\"#68BC00\",\"id\":\"b6262af0-52d0-11e8-a1cd-61c073d732d5\"},{\"filter\":\"status: WARNING\",\"label\":\"WARNING\",\"color\":\"rgba(252,220,0,1)\",\"id\":\"b9c91b40-52d0-11e8-a1cd-61c073d732d5\"},{\"filter\":\"status: CRITICAL\",\"label\":\"CRITICAL\",\"color\":\"rgba(244,78,59,1)\",\"id\":\"c95387d0-52d0-11e8-a1cd-61c073d732d5\"}],\"split_color_mode\":\"gradient\",\"hide_in_legend\":0,\"color_rules\":[{\"value\":0,\"id\":\"7eae92e0-52d2-11e8-a1cd-61c073d732d5\",\"text\":\"rgba(52,199,64,1)\",\"opperator\":\"gt\"}],\"offset_time\":\"\",\"value_template\":\"\"},{\"id\":\"50dd0800-52d3-11e8-a1cd-61c073d732d5\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"50dd0801-52d3-11e8-a1cd-61c073d732d5\",\"type\":\"count\",\"field\":\"name\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\",\"label\":\"WARNING\",\"color_rules\":[{\"value\":0,\"id\":\"702721f0-52d3-11e8-a1cd-61c073d732d5\",\"text\":\"rgba(236,214,44,1)\",\"opperator\":\"gt\"}],\"filter\":\"status:WARNING\",\"offset_time\":\"\",\"value_template\":\"\"},{\"id\":\"7fa9c650-52d3-11e8-a1cd-61c073d732d5\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"7fa9c651-52d3-11e8-a1cd-61c073d732d5\",\"type\":\"count\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\",\"label\":\"CRITICAL\",\"color_rules\":[{\"value\":0,\"id\":\"9c22bee0-52d3-11e8-a1cd-61c073d732d5\",\"text\":\"rgba(255,2,16,1)\",\"opperator\":\"gt\"}],\"filter\":\"status:CRITICAL\",\"offset_time\":\"\",\"value_template\":\"\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"nagios*\",\"interval\":\"10m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":0,\"gauge_color_rules\":[{\"id\":\"6bbfd790-52d0-11e8-a1cd-61c073d732d5\"}],\"gauge_width\":10,\"gauge_inner_width\":10,\"gauge_style\":\"half\",\"bar_color_rules\":[{\"id\":\"42bc8120-52d2-11e8-a1cd-61c073d732d5\"}],\"background_color_rules\":[{\"id\":\"4d7a4a70-52d2-11e8-a1cd-61c073d732d5\"}],\"pivot_id\":\"host\",\"pivot_label\":\"Status in the Last 10 Minutes\",\"markdown\":\"{{warning.last.raw}}\",\"pivot_rows\":\"100\",\"drop_last_bucket\":0},\"aggs\":[]}",
+    "uiStateJSON": "{}",
+    "description": "",
+    "version": 1,
+    "kibanaSavedObjectMeta": {
+        "searchSourceJSON": "{}"
+    }
+}

data/module/kibana/6.x/visualization/d602cb70-52d1-11e8-8d6e-5ded8718dfbd.json

@@ -0,0 +1,10 @@
+{
+    "title": "Status Overview",
+    "visState": "{\"title\":\"Status Overview\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"timeseries\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"filters\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"cardinality\",\"field\":\"name\"},{\"id\":\"ee99b260-52d2-11e8-a1cd-61c073d732d5\",\"type\":\"count\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"bar\",\"line_width\":\"0\",\"point_size\":1,\"fill\":\"0.5\",\"stacked\":\"stacked\",\"terms_field\":\"label.keyword\",\"label\":\"OK\",\"filter\":\"\",\"split_filters\":[{\"filter\":\"status: OK\",\"label\":\"OK\",\"color\":\"#68BC00\",\"id\":\"b6262af0-52d0-11e8-a1cd-61c073d732d5\"},{\"filter\":\"status: WARNING\",\"label\":\"WARNING\",\"color\":\"rgba(252,220,0,1)\",\"id\":\"b9c91b40-52d0-11e8-a1cd-61c073d732d5\"},{\"filter\":\"status: CRITICAL\",\"label\":\"CRITICAL\",\"color\":\"rgba(244,78,59,1)\",\"id\":\"c95387d0-52d0-11e8-a1cd-61c073d732d5\"}],\"split_color_mode\":\"gradient\",\"hide_in_legend\":0,\"color_rules\":[{\"id\":\"7eae92e0-52d2-11e8-a1cd-61c073d732d5\"}]}],\"time_field\":\"@timestamp\",\"index_pattern\":\"nagios*\",\"interval\":\"\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":0,\"gauge_color_rules\":[{\"id\":\"6bbfd790-52d0-11e8-a1cd-61c073d732d5\"}],\"gauge_width\":10,\"gauge_inner_width\":10,\"gauge_style\":\"half\",\"bar_color_rules\":[{\"id\":\"42bc8120-52d2-11e8-a1cd-61c073d732d5\"}],\"background_color_rules\":[{\"id\":\"4d7a4a70-52d2-11e8-a1cd-61c073d732d5\"}],\"pivot_id\":\"name\",\"pivot_label\":\"Name\",\"markdown\":\"{{warning.last.raw}}\"},\"aggs\":[]}",
+    "uiStateJSON": "{}",
+    "description": "",
+    "version": 1,
+    "kibanaSavedObjectMeta": {
+      "searchSourceJSON": "{}"
+    }
+  }

data/module/kibana/6.x/visualization/e1b3e380-52d3-11e8-8d6e-5ded8718dfbd.json

@@ -0,0 +1,10 @@
+{
+    "title": "Status Overview By Service",
+    "visState": "{\"title\":\"Status Overview By Service\",\"type\":\"metrics\",\"params\":{\"id\":\"61ca57f0-469d-11e7-af02-69e470af7417\",\"type\":\"table\",\"series\":[{\"id\":\"61ca57f1-469d-11e7-af02-69e470af7417\",\"color\":\"#68BC00\",\"split_mode\":\"filters\",\"metrics\":[{\"id\":\"61ca57f2-469d-11e7-af02-69e470af7417\",\"type\":\"count\",\"field\":\"name\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"bar\",\"line_width\":\"0\",\"point_size\":1,\"fill\":\"0.5\",\"stacked\":\"stacked\",\"terms_field\":\"label.keyword\",\"label\":\"OK\",\"filter\":\"status:OK\",\"split_filters\":[{\"filter\":\"status: OK\",\"label\":\"OK\",\"color\":\"#68BC00\",\"id\":\"b6262af0-52d0-11e8-a1cd-61c073d732d5\"},{\"filter\":\"status: WARNING\",\"label\":\"WARNING\",\"color\":\"rgba(252,220,0,1)\",\"id\":\"b9c91b40-52d0-11e8-a1cd-61c073d732d5\"},{\"filter\":\"status: CRITICAL\",\"label\":\"CRITICAL\",\"color\":\"rgba(244,78,59,1)\",\"id\":\"c95387d0-52d0-11e8-a1cd-61c073d732d5\"}],\"split_color_mode\":\"gradient\",\"hide_in_legend\":0,\"color_rules\":[{\"value\":0,\"id\":\"7eae92e0-52d2-11e8-a1cd-61c073d732d5\",\"text\":\"rgba(52,199,64,1)\",\"opperator\":\"gt\"}],\"offset_time\":\"\",\"value_template\":\"\"},{\"id\":\"50dd0800-52d3-11e8-a1cd-61c073d732d5\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"50dd0801-52d3-11e8-a1cd-61c073d732d5\",\"type\":\"count\",\"field\":\"name\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\",\"label\":\"WARNING\",\"color_rules\":[{\"value\":0,\"id\":\"702721f0-52d3-11e8-a1cd-61c073d732d5\",\"text\":\"rgba(236,214,44,1)\",\"opperator\":\"gt\"}],\"filter\":\"status:WARNING\",\"offset_time\":\"\",\"value_template\":\"\"},{\"id\":\"7fa9c650-52d3-11e8-a1cd-61c073d732d5\",\"color\":\"#68BC00\",\"split_mode\":\"everything\",\"metrics\":[{\"id\":\"7fa9c651-52d3-11e8-a1cd-61c073d732d5\",\"type\":\"count\"}],\"seperate_axis\":0,\"axis_position\":\"right\",\"formatter\":\"number\",\"chart_type\":\"line\",\"line_width\":1,\"point_size\":1,\"fill\":0.5,\"stacked\":\"none\",\"label\":\"CRITICAL\",\"color_rules\":[{\"value\":0,\"id\":\"9c22bee0-52d3-11e8-a1cd-61c073d732d5\",\"text\":\"rgba(255,2,16,1)\",\"opperator\":\"gt\"}],\"filter\":\"status:CRITICAL\",\"offset_time\":\"\",\"value_template\":\"\"}],\"time_field\":\"@timestamp\",\"index_pattern\":\"nagios*\",\"interval\":\"10m\",\"axis_position\":\"left\",\"axis_formatter\":\"number\",\"show_legend\":1,\"show_grid\":0,\"gauge_color_rules\":[{\"id\":\"6bbfd790-52d0-11e8-a1cd-61c073d732d5\"}],\"gauge_width\":10,\"gauge_inner_width\":10,\"gauge_style\":\"half\",\"bar_color_rules\":[{\"id\":\"42bc8120-52d2-11e8-a1cd-61c073d732d5\"}],\"background_color_rules\":[{\"id\":\"4d7a4a70-52d2-11e8-a1cd-61c073d732d5\"}],\"pivot_id\":\"name\",\"pivot_label\":\"Status in the Last 10 Minutes\",\"markdown\":\"{{warning.last.raw}}\",\"pivot_rows\":\"100\",\"drop_last_bucket\":0},\"aggs\":[]}",
+    "uiStateJSON": "{}",
+    "description": "",
+    "version": 1,
+    "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{}"
+    }
+}

data/module/kibana/6.x/visualization/e6d01410-52d8-11e8-8d6e-5ded8718dfbd.json

@@ -0,0 +1,10 @@
+{
+  "title": "Status of All Hosts",
+  "visState": "{\"title\":\"Status of All Hosts\",\"type\":\"pie\",\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":false,\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"cardinality\",\"schema\":\"metric\",\"params\":{\"field\":\"host\",\"customLabel\":\"Hosts\"}},{\"id\":\"2\",\"enabled\":true,\"type\":\"filters\",\"schema\":\"segment\",\"params\":{\"filters\":[{\"input\":{\"query\":\"status:OK\"},\"label\":\"OK\"},{\"input\":{\"query\":\"status:CRITICAL\"},\"label\":\"Critical\"},{\"input\":{\"query\":\"status:WARNING\"},\"label\":\"Warning\"}]}}]}",
+  "uiStateJSON": "{\"vis\":{\"colors\":{\"Critical\":\"#F29191\",\"OK\":\"#B7DBAB\",\"Warning\":\"#F4D598\"}}}",
+  "description": "",
+  "version": 1,
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{\"index\":\"nagios-*\",\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}"
+  }
+}

data/module/logstash/nagios.conf.erb

@@ -0,0 +1,10 @@
+input {
+  nagioscheck {
+    name => "my_dummy_check"
+    command => "/usr/local/sbin/check_dummy 0 Hello"
+    interval => "10"
+  }
+}
+output {
+ <%= elasticsearch_output_config() %>
+}

data/spec/inputs/nagioscheck_spec.rb

@@ -0,0 +1,238 @@
+# encoding: utf-8
+require "logstash/devutils/rspec/spec_helper"
+require "logstash/inputs/nagioscheck"
+
+
+describe LogStash::Inputs::Nagioscheck do
+
+  it_behaves_like "an interruptible input plugin" do
+    let(:config) { { "name" => "my_load_check", "command" => "/usr/local/sbin/check_load -w 1,2,3 -c 4,5,6",  "interval" => 100 } }
+  end
+
+
+  context "when we simulate certain output 1" do
+    let(:input) { LogStash::Plugin.lookup("input", "nagioscheck").new("name" => "my_load_check", "command" => "echo 'Everything OK | load1=0.010;5.000;9.000;0; load5=0.060;5.000;9.000;0; load15=2.010;5.000;9.000;0;'", "interval" => 0) }
+    let(:queue) { [] }
+
+    before do
+      input.register
+      input.execute(queue)
+    end
+
+    after do
+      input.stop
+    end
+
+    it "it parses out properly" do
+      expect(queue.length).to eq 4
+
+      expect(queue[0].get("value")).to eq 0.01
+
+      expect(queue[1].get("value")).to eq 0.06
+      expect(queue[1].get("label")).to eq "load5"     
+      
+      expect(queue[2].get("value")).to eq 2.01
+
+      expect(queue[3].get("message")).to eq "Everything OK"
+      expect(queue[3].get("status")).to eq "OK"
+      expect(queue[3].get("took_ms")).to be > 0
+
+    end
+
+  end
+
+  context "when we simulate certain output 2" do
+    let(:input) { LogStash::Plugin.lookup("input", "nagioscheck").new("name" => "my_check", "command" => "echo 'Everything OK | users=4;20;50;0'", "interval" => 0) }
+    let(:queue) { [] }
+
+    before do
+      input.register
+      input.execute(queue)
+    end
+
+    after do
+      input.stop
+    end
+
+    it "it parses out properly" do
+      
+      expect(queue.length).to eq 2
+
+      expect(queue[0].get("value")).to eq 4
+      expect(queue[0].get("warning")).to eq 20
+      expect(queue[0].get("critical")).to eq 50     
+      expect(queue[0].get("min")).to eq 0
+
+      expect(queue[1].get("message")).to eq "Everything OK"
+      expect(queue[1].get("status")).to eq "OK"
+      expect(queue[1].get("took_ms")).to be > 0
+
+    end
+
+  end
+
+
+
+
+  context "when we simulate certain output 3 - quoted strings" do
+    let(:input) { LogStash::Plugin.lookup("input", "nagioscheck").new("name" => "my_check", "command" => "echo 'Some Disk Data | /home/a-m=0;0;0 '\"'\"'i have spaces'\"'\"'=20 '\"'\"'12345678901234567890'\"'\"'=20'", "interval" => 0) }
+    let(:queue) { [] }
+
+    before do
+      input.register
+      input.execute(queue)
+    end
+
+    after do
+      input.stop
+    end
+
+    it "it parses out properly" do
+      
+      expect(queue.length).to eq 4
+
+      expect(queue[0].get("label")).to eq  "/home/a-m"     
+      expect(queue[0].get("value")).to eq  0
+      expect(queue[0].get("warning")).to eq  0 
+      expect(queue[0].get("critical")).to eq  0
+      expect(queue[1].get("label")).to eq  "i have spaces"     
+      expect(queue[1].get("value")).to eq  20
+      expect(queue[2].get("label")).to eq  "12345678901234567890"     
+      expect(queue[2].get("value")).to eq  20
+
+      expect(queue[3].get("status")).to eq  "OK"
+
+    end
+
+  end
+
+  context "when we simulate certain output 4" do
+    let(:input) { LogStash::Plugin.lookup("input", "nagioscheck").new("name" => "my_uom_check", "command" => "echo 'Some Float Parsing with Uom | time=0.002722s;0.000000;0.000000;0.000000;10.000000'", "interval" => 0) }
+    let(:queue) { [] }
+
+    before do
+      input.register
+      input.execute(queue)
+    end
+
+    after do
+      input.stop
+    end
+
+    it "it parses out properly" do
+      
+      expect(queue.length).to eq 2
+
+      expect(queue[0].get("label")).to eq  "time"     
+      expect(queue[0].get("value")).to eq  0.002722
+      expect(queue[0].get("uom")).to eq "s"
+      expect(queue[0].get("max")).to eq 10
+     
+    end
+
+  end
+
+
+  context "when we simulate malformed output" do
+    let(:input) { LogStash::Plugin.lookup("input", "nagioscheck").new("name" => "my_broken_plugin", "failure_tag" => "i_must_appear", "command" => "echo 'Some Status | invalid;perf data'", "interval" => 0) }
+    let(:queue) { [] }
+
+    before do
+      input.register
+      input.execute(queue)
+    end
+
+    after do
+      input.stop
+    end
+
+    it "it tags with parse failure" do
+      expect(queue[0].get("tags")).to include("i_must_appear")     
+    end
+
+  end
+ 
+  context "when we have a string in the perf data" do
+    let(:input) { LogStash::Plugin.lookup("input", "nagioscheck").new("name" => "my_broken_plugin", "failure_tag" => "i_must_appear", "command" => "echo 'String in perf data is parsed as 0| time=0.002722s;0.000000;string;0.000000;10.000000'", "interval" => 0) }
+    let(:queue) { [] }
+
+    before do
+      input.register
+      input.execute(queue)
+    end
+
+    after do
+      input.stop
+    end
+
+    it "it parses it as 0" do
+      expect(queue[0].get("critical")).to eq 0   
+    end
+
+  end
+
+
+  context "when we have empty output" do
+    let(:input) { LogStash::Plugin.lookup("input", "nagioscheck").new("name" => "my_broken_plugin", "failure_tag" => "i_must_appear", "command" => "echo ''", "interval" => 0) }
+    let(:queue) { [] }
+
+    before do
+      input.register
+      input.execute(queue)
+    end
+
+    after do
+      input.stop
+    end
+
+    it "it's ignored" do
+      expect(queue[0].get("status")).to eq "OK"   
+    end
+
+  end
+
+  context "when a real check runs" do
+    let(:input) { LogStash::Plugin.lookup("input", "nagioscheck").new("name" => "my_load_check", "command" => "/usr/local/sbin/check_load -w 0,2,3 -c 0,5,6", "interval" => 0) }
+    let(:queue) { [] }
+
+    before do
+      input.register
+      input.execute(queue)
+    end
+
+    after do
+      input.stop
+    end
+
+    it "it parses out properly" do
+
+      expect(queue[0].get('type')).to eq "nagiosmetric"
+      expect(queue[0].get('name')).to eq "my_load_check"
+      expect(queue[0].get('label')).to eq "load1"
+      expect(queue[0].get('warning')).to eq 0
+      expect(queue[0].get('critical')).to eq 0
+      expect(queue[0].get('min')).to eq 0
+
+      expect(queue[1].get('label')).to eq "load5"
+      expect(queue[1].get('warning')).to eq 2
+      expect(queue[1].get('critical')).to eq 5
+      expect(queue[1].get('min')).to eq 0
+
+      expect(queue[2].get('label')).to eq "load15"
+      expect(queue[2].get('warning')).to eq 3
+      expect(queue[2].get('critical')).to eq 6
+      expect(queue[2].get('min')).to eq 0
+
+      expect(queue[3].get('message')).not_to be_nil
+      expect(queue[3].get('message')).to include("load average")
+      expect(queue[3].get('status')).to eq "CRITICAL"
+      expect(queue[3].get('name')).to eq "my_load_check"
+      expect(queue[3].get('took_ms')).to be > 0
+      expect(queue[3].get('type')).to eq "nagioscheck"
+
+    end
+
+
+  end
+
+end

metadata

@@ -0,0 +1,149 @@
+--- !ruby/object:Gem::Specification
+name: logstash-input-nagioscheck
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Jay Greenberg
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2018-05-09 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  name: logstash-core-plugin-api
+  prerelease: false
+  type: :runtime
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+- !ruby/object:Gem::Dependency
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  name: logstash-codec-plain
+  prerelease: false
+  type: :runtime
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 3.3.0
+  name: logstash-input-exec
+  prerelease: false
+  type: :runtime
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 3.3.0
+- !ruby/object:Gem::Dependency
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.0.22
+  name: stud
+  prerelease: false
+  type: :runtime
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.0.22
+- !ruby/object:Gem::Dependency
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.0.16
+  name: logstash-devutils
+  prerelease: false
+  type: :development
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.0.16
+- !ruby/object:Gem::Dependency
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 3.3.0
+  name: logstash-input-exec
+  prerelease: false
+  type: :development
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 3.3.0
+description: Parses the output of Nagios Checks (via exec input)
+email: jay.greenberg@elastic.co
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- CONTRIBUTORS
+- DEVELOPER.md
+- Gemfile
+- LICENSE
+- README.md
+- lib/logstash/inputs/nagioscheck.rb
+- lib/logstash_registry.rb
+- logstash-input-nagioscheck.gemspec
+- module/elasticsearch/nagios.json
+- module/kibana/6.x/dashboard/Nagios Overview.json
+- module/kibana/6.x/dashboard/nagios.json
+- module/kibana/6.x/index-pattern/nagios.json
+- module/kibana/6.x/visualization/7b67a110-52d9-11e8-8d6e-5ded8718dfbd.json
+- module/kibana/6.x/visualization/d602cb70-52d1-11e8-8d6e-5ded8718dfbd.json
+- module/kibana/6.x/visualization/e1b3e380-52d3-11e8-8d6e-5ded8718dfbd.json
+- module/kibana/6.x/visualization/e6d01410-52d8-11e8-8d6e-5ded8718dfbd.json
+- module/logstash/nagios.conf.erb
+- spec/inputs/nagioscheck_spec.rb
+homepage: http://www.elastic.co
+licenses:
+- Apache-2.0
+metadata:
+  logstash_plugin: 'true'
+  logstash_group: input
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project:
+rubygems_version: 2.6.13
+signing_key:
+specification_version: 4
+summary: Logstash NagiosCheck Filter
+test_files:
+- spec/inputs/nagioscheck_spec.rb