logstash-output-zabbix 0.1.4 → 1.0.0

data/lib/logstash/outputs/zabbix.rb

@@ -54,13 +54,28 @@ class LogStash::Outputs::Zabbix < LogStash::Outputs::Base
   # the @metadata field.
   config :zabbix_host, :validate => :string, :required => true
 
-  # The field name which holds the Zabbix key. This can be a sub-field of
-  # the @metadata field.
-  config :zabbix_key, :validate => :string, :required => true
+  # A single field name which holds the value you intend to use as the Zabbix
+  # item key. This can be a sub-field of the @metadata field.
+  # This directive will be ignored if using `multi_value`
+  config :zabbix_key, :validate => :string
 
   # The field name which holds the value you want to send.
+  # This directive will be ignored if using `multi_value`
   config :zabbix_value, :validate => :string, :default => "message"
 
+  # Use the `multi_value` directive to send multiple key/value pairs.
+  # This can be thought of as an array, like:
+  #
+  # `[ zabbix_key1, zabbix_value1, zabbix_key2, zabbix_value2, ... zabbix_keyN, zabbix_valueN ]`
+  #
+  # ...where `zabbix_key1` is an instance of `zabbix_key`, and `zabbix_value1`
+  # is an instance of `zabbix_value`.  If the field referenced by any
+  # `zabbix_key` or `zabbix_value` does not exist, that entry will be ignored.
+  #
+  # This directive cannot be used in conjunction with the single-value directives
+  # `zabbix_key` and `zabbix_value`.
+  config :multi_value, :validate => :array
+
   # The number of seconds to wait before giving up on a connection to the Zabbix
   # server. This number should be very small, otherwise delays in delivery of
   # other outputs could result.
@@ -68,31 +83,71 @@ class LogStash::Outputs::Zabbix < LogStash::Outputs::Base
 
   public
   def register
+    if !@zabbix_key.nil? && !@multi_value.nil?
+      @logger.warn("Cannot use multi_value in conjunction with zabbix_key/zabbix_value.  Ignoring zabbix_key.")
+    end
+
+    # We're only going to use @multi_value in the end, so let's build it from
+    # @zabbix_key and @zabbix_value if it is empty (single value configuration).
+    if @multi_value.nil?
+      @multi_value = [ @zabbix_key, @zabbix_value ]
+    end
+    if @multi_value.length % 2 == 1
+      raise LogStash::ConfigurationError, I18n.t("logstash.agent.configuration.invalid_plugin_register",
+        :plugin => "output", :type => "zabbix",
+        :error => "Invalid zabbix configuration #{@multi_value}. multi_value requires an even number of elements as ['zabbix_key1', 'zabbix_value1', 'zabbix_key2', 'zabbix_value2']")
+    end
   end # def register
 
   public
   def field_check(event, fieldname)
     if !event[fieldname]
-      @logger.warn("Skipping zabbix output; field referenced by #{fieldname} is missing")
+      @logger.warn("Field referenced by #{fieldname} is missing")
       false
     else
       true
     end
   end
 
+  public
+  def kv_check(event, key_field, value_field)
+    errors = 0
+    for field in [key_field, value_field]
+      errors += 1 unless field_check(event, field)
+    end
+    errors < 1 ? true : false
+  end # kv_check
+
+  public
+  def validate_fields(event)
+    found = []
+    (0..@multi_value.length-1).step(2) do |idx|
+      if kv_check(event, @multi_value[idx], @multi_value[idx+1])
+        found << @multi_value[idx]
+        found << @multi_value[idx+1]
+      end
+    end
+    found
+  end # validate_fields
+
   public
   def format_request(event)
     # The nested `clock` value is the event timestamp
     # The ending `clock` value is "now" so Zabbix knows it's not receiving stale
     # data.
+    validated = validate_fields(event)
+    data = []
+    (0..validated.length-1).step(2) do |idx|
+      data << {
+        "host"  => event[@zabbix_host],
+        "key"   => event[validated[idx]],
+        "value" => event[validated[idx+1]],
+        "clock" => event["@timestamp"].to_i
+      }
+    end
     {
       "request" => "sender data",
-      "data" => [{
-        "host" => event[@zabbix_host],
-        "key" => event[@zabbix_key],
-        "value" => event[@zabbix_value].to_s,
-        "clock" => event["@timestamp"].to_i
-      }],
+      "data" => data,
       "clock" => Time.now.to_i,
     }
   end
@@ -125,16 +180,12 @@ class LogStash::Outputs::Zabbix < LogStash::Outputs::Base
     total = info[5].to_i
     if failed == total
       @logger.warn("Zabbix server at #{@zabbix_server_host} rejected all items sent.",
-        :zabbix_host => event[@zabbix_host],
-        :zabbix_key => event[@zabbix_key],
-        :zabbix_value => event[@zabbix_value]
+        :zabbix_host => event[@zabbix_host]
       )
       false
     elsif failed > 0
       @logger.warn("Zabbix server at #{@zabbix_server_host} rejected #{info[3]} item(s).",
-        :zabbix_host => event[@zabbix_host],
-        :zabbix_key => event[@zabbix_key],
-        :zabbix_value => event[@zabbix_value]
+        :zabbix_host => event[@zabbix_host]
       )
       false
     elsif failed == 0 && total > 0
@@ -184,9 +235,7 @@ class LogStash::Outputs::Zabbix < LogStash::Outputs::Base
   public
   def receive(event)
     return unless output?(event)
-    for field in [@zabbix_host, @zabbix_key, @zabbix_value]
-      return unless field_check(event, field)
-    end
+    return unless field_check(event, @zabbix_host)
     send_to_zabbix(event)
   end # def event
 

data/logstash-output-zabbix.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name          = 'logstash-output-zabbix'
-  s.version       = "0.1.4"
+  s.version       = "1.0.0"
   s.licenses      = ["Apache License (2.0)"]
   s.summary       = "This output sends key/value pairs to a Zabbix server."
   s.description   = "This gem is a logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/plugin install gemname. This gem is not a stand-alone program"
@@ -23,5 +23,5 @@ Gem::Specification.new do |s|
   s.add_runtime_dependency "logstash-codec-plain"
   s.add_development_dependency "logstash-devutils", ">= 0.0.12"
   s.add_development_dependency "logstash-filter-mutate"
-  s.add_development_dependency "docker-api"
+  s.add_development_dependency "longshoreman"
 end

data/spec/helpers/zabbix_helper.rb

@@ -0,0 +1,69 @@
+module ZabbixHelper
+
+  # This is used to ensure the (Docker) Zabbix port is up and running
+  def port_open?(ip, port, seconds=1)
+    Timeout::timeout(seconds) do
+      begin
+        TCPSocket.new(ip, port).close
+        true
+      rescue Errno::ECONNREFUSED, Errno::EHOSTUNREACH
+        false
+      end
+    end
+  rescue Timeout::Error
+    false
+  end
+
+  def port_responding?(ip, port)
+    # Try for up to 10 seconds to get a response
+    10.times do
+      if port_open?(ip, port)
+        return true
+      else
+        sleep 1
+      end
+    end
+    false
+  end
+
+  def zabbix_server_up?(zabbix_ip, port)
+    data = {
+        "request" => "sender data",
+        "data" => [{
+          "host"  => "zabbix.example.com",
+          "key"   => "zabbix.key",
+          "value" => "This is a log entry.",
+          "clock" => 1429100000,
+        }],
+        "clock" => Time.now.to_i,
+    }
+    if port_responding?(zabbix_ip, port)
+      ###
+      ### This is a hacky way to guarantee that Zabbix is responsive, because the
+      ### port check alone is insufficient.  TCP tests say the port is open, but
+      ### it can take another 2 to 5 seconds (depending on the machine) before it
+      ### is responding in the way we need for these tests.
+      ###
+      resp = ""
+      # Try for up to 10 seconds to get a response.
+      10.times do
+        TCPSocket.open(zabbix_ip, port) do |sock|
+          sock.print ZabbixProtocol.dump(data)
+          resp = sock.read
+        end
+        if resp.length == 0
+          sleep 1
+        else
+          return true
+        end
+      end
+      if resp.length == 0
+        puts "Zabbix server or db is unreachable"
+      end
+    else
+      puts "Unable to reach Zabbix server on #{zabbix_ip}:#{port}"
+    end
+    false
+  end
+  
+end

data/spec/outputs/zabbix_spec.rb

@@ -5,97 +5,21 @@ require "logstash/event"
 require "zabbix_protocol"
 require "socket"
 require "timeout"
-require "docker"
+require "longshoreman"
+require_relative "../helpers/zabbix_helper"
 
-
-CONTAINER_NAME = "zabbix_container_" + rand(99).to_s
-IMAGE = "untergeek/logstash_output_zabbix_rspec"
-TAG = "zabbix_v2.2.2"
-
-# This is used to ensure the Docker Zabbix port is up and running
-def port_open?(ip, port, seconds=1)
-  Timeout::timeout(seconds) do
-    begin
-      TCPSocket.new(ip, port).close
-      true
-    rescue Errno::ECONNREFUSED, Errno::EHOSTUNREACH
-      false
-    end
-  end
-rescue Timeout::Error
-  false
-end
-
-def get_docker_ip
-  # Let the crazy one-liner definition begin:
-  # Docker.url.split(':')[1][2..-1]
-  # Docker.url = tcp://192.168.123.205:2375
-  #   split(':') = ["tcp", "//192.168.123.205", "2375"]
-  #   [1] = "//192.168.123.205"
-  #   [2..-1] = "192.168.123.205"
-  # This last bit prunes the leading //
-  url = Docker.url
-  ip = "127.0.0.1"
-  case url.split(':')[0]
-  when 'unix'
-    ip = "127.0.0.1"
-  when 'tcp'
-    ip = url.split(':')[1][2..-1]
-  end
-  ip
+RSpec.configure do |c|
+  c.include ZabbixHelper
 end
 
-def port_responding?(ip, port)
-  # Try for up to 10 seconds to get a response
-  10.times do
-    if port_open?(ip, port)
-      return true
-    else
-      sleep 1
-    end
-  end
-  false
-end
-
-def zabbix_server_up?
-  zabbix_ip = get_docker_ip
-  port = 10051
-  test_cfg = { "zabbix_server_host" => zabbix_ip, "zabbix_host" => "zabhost", "zabbix_key" => "zabkey", "zabbix_value" => "message" }
-  test_event = LogStash::Event.new({ "message" => "This is a log entry.", "zabhost" => "zabbix.example.com", "zabkey" => "zabbix.key" })
-  test_out = LogStash::Outputs::Zabbix.new(test_cfg)
-  data = test_out.format_request(test_event)
-  if port_responding?(zabbix_ip, port)
-    ###
-    ### This is a hacky way to guarantee that Zabbix is responsive, because the
-    ### port check alone is insufficient.  TCP tests say the port is open, but
-    ### it can take another 2 to 5 seconds (depending on the machine) before it
-    ### is responding in the way we need for these tests.
-    ###
-    resp = ""
-    # Try for up to 10 seconds to get a response.
-    10.times do
-      TCPSocket.open(zabbix_ip, port) do |sock|
-        sock.print ZabbixProtocol.dump(data)
-        resp = sock.read
-      end
-      if resp.length == 0
-        sleep 1
-      else
-        return true
-      end
-    end
-    if resp.length == 0
-      puts "Zabbix server or db is unreachable"
-    end
-  else
-    puts "Unable to reach Zabbix server on #{zabbix_ip}:#{port}"
-  end
-  false
-end
+NAME = "logstash-output-zabbix-#{rand(999).to_s}"
+IMAGE = "untergeek/logstash_output_zabbix_rspec"
+TAG = "latest"
+ZABBIX_PORT = 10051
 
 describe LogStash::Outputs::Zabbix do
   # Building block "lets"
-  let(:port) { 10051 }
+  let(:port) { ZABBIX_PORT }
   let(:host) { "127.0.0.1" }
   let(:timeout) { 1 }
   let(:timestamp) { "2015-04-15T15:39:42Z" }
@@ -113,13 +37,33 @@ describe LogStash::Outputs::Zabbix do
       "zabkey"  => zabkey,
     }
   }
+  let(:multi_value) {
+    {
+      "@timestamp" => timestamp,
+      "message"    => message,
+      "zabhost"    => zabhost,
+      "key1"       => "multi1",
+      "val1"       => "value1",
+      "key2"       => "multi2",
+      "val2"       => "value2",
+    }
+  }
   let(:zabout) {
     {
       "zabbix_server_host" => host,
       "zabbix_server_port" => port,
-      "zabbix_host" => "zabhost",
-      "zabbix_key" => "zabkey",
-      "timeout" => timeout
+      "zabbix_host"        => "zabhost",
+      "zabbix_key"         => "zabkey",
+      "timeout"            => timeout,
+    }
+  }
+  let(:mzabout) {
+    {
+      "zabbix_server_host" => host,
+      "zabbix_server_port" => port,
+      "zabbix_host"        => "zabhost",
+      "multi_value"        => ["key1", "val1", "key2", "val2"],
+      "timeout"            => timeout,
     }
   }
 
@@ -132,22 +76,27 @@ describe LogStash::Outputs::Zabbix do
   end
 
   describe "Unit Tests" do
+
     describe "#field_check" do
+
       context "when expected field not found" do
         subject { output.field_check(string_event, "not_appearing") }
         it "should return false" do
           expect(subject).to eq(false)
         end
       end
+
       context "when expected field found" do
         subject { output.field_check(string_event, "zabhost") }
         it "should return true" do
           expect(subject).to eq(true)
         end
       end
-    end
 
-    describe "#format_request" do
+    end # "#field_check"
+
+    describe "#format_request (single key/value pair)" do
+
       context "when it receives an event" do
         # {
         #   "request" => "sender data",
@@ -177,9 +126,52 @@ describe LogStash::Outputs::Zabbix do
           expect(diff).to be < 3 # It should take less than 3 seconds for this.
         end
       end
-    end
+
+    end # "#format_request (single key/value pair)"
+
+    describe "#format_request (multiple key/value pairs)" do
+      let(:multival_event) { LogStash::Event.new(multi_value) }
+      let(:m_output) { LogStash::Outputs::Zabbix.new(mzabout) }
+
+      context "when it receives an event and is configured for multiple values" do
+        subject { m_output.format_request(multival_event) }
+        it "should return a Zabbix sender data object with a data array" do
+          expect(subject['data'].length).to eq(2)
+        end
+        it "should return a Zabbix sender data object with the correct host [0]" do
+          expect(subject['data'][0]['host']).to eq(zabhost)
+        end
+        it "should return a Zabbix sender data object with the correct key [0]" do
+          expect(subject['data'][0]['key']).to eq('multi1')
+        end
+        it "should return a Zabbix sender data object with the correct value [0]" do
+          expect(subject['data'][0]['value']).to eq('value1')
+        end
+        it "should return a Zabbix sender data object with the correct clock from @timestamp [0]" do
+          expect(subject['data'][0]['clock']).to eq(epoch)
+        end
+        it "should return a Zabbix sender data object with the correct host [1]" do
+          expect(subject['data'][1]['host']).to eq(zabhost)
+        end
+        it "should return a Zabbix sender data object with the correct key [1]" do
+          expect(subject['data'][1]['key']).to eq('multi2')
+        end
+        it "should return a Zabbix sender data object with the correct value [1]" do
+          expect(subject['data'][1]['value']).to eq('value2')
+        end
+        it "should return a Zabbix sender data object with the correct clock from @timestamp [1]" do
+          expect(subject['data'][1]['clock']).to eq(epoch)
+        end
+        it "should return a Zabbix sender data object with the correct clock" do
+          diff = Time.now.to_i - subject['clock']
+          expect(diff).to be < 3 # It should take less than 3 seconds for this.
+        end
+      end
+
+    end # "#format_request (multiple key/value pairs)"
 
     describe "#response_check" do
+
       context "when it receives a success value" do
         subject { output.response_check(string_event, { "response" => "success" } ) }
         it "should return true" do
@@ -200,9 +192,11 @@ describe LogStash::Outputs::Zabbix do
           expect(subject).to eq(false)
         end
       end
-    end
+
+    end # "#response_check"
 
     describe "#info_check" do
+
       context "when it receives a success value" do
         let(:success_msg) { {"response" => "success", "info" => "processed 1; Failed 0; Total 1; seconds spent: 0.000018"} }
         subject { output.info_check(string_event, success_msg) }
@@ -225,45 +219,33 @@ describe LogStash::Outputs::Zabbix do
           expect(subject).to eq(false)
         end
       end
-    end
 
-  end
+    end # "#info_check"
+
+  end # "Unit Tests"
 
   describe "Integration Tests", :integration => true do
-    let(:host) { get_docker_ip }
 
-    # Only open the container once for all tests.
     before(:all) do
-      zabbix_ip = get_docker_ip
-      port = 10051
-      container = Docker::Container.create(
-        "name" => CONTAINER_NAME,
-        "Cmd" => ["run"],
-        "Image" => "#{IMAGE}:#{TAG}",
-        "ExposedPorts" => { "#{port}/tcp" => {} },
-        "Tty" => true,
-        "HostConfig" => {
-          "PortBindings" => {
-            "#{port}/tcp" => [
-              {
-                "HostIp" => "",
-                "HostPort" => "#{port}"
-              }
-            ]
-          }
-        }
+      @zabbix = Longshoreman.new(
+        "#{IMAGE}:#{TAG}",    # Image to use
+        NAME,                 # Container name
+        {
+          "Cmd" => ["run"],
+          "Tty" => true,
+        }                     # Extra options, if any
       )
-      container.start
-      zabbix_server_up?
+      zabbix_server_up?(@zabbix.ip, @zabbix.container.rport(ZABBIX_PORT))
     end
 
     after(:all) do
-      container = Docker::Container.get(CONTAINER_NAME)
-      container.stop
-      container.delete(:force => true)
+      @zabbix.cleanup
     end
 
     describe "#tcp_send", :integration => true do
+      let(:port) { @zabbix.container.rport(ZABBIX_PORT) }
+      let(:host) { @zabbix.ip }
+
       context "when the Zabbix server responds with 'success'" do
         subject { output.tcp_send(string_event) }
         it "should return true" do
@@ -279,9 +261,24 @@ describe LogStash::Outputs::Zabbix do
         end
       end
 
-    end
+      context "when multiple values are sent" do
+        let(:port) { @zabbix.container.rport(ZABBIX_PORT) }
+        let(:host) { @zabbix.ip }
+        let(:multival_event) { LogStash::Event.new(multi_value) }
+        let(:m_output) { LogStash::Outputs::Zabbix.new(mzabout) }
+
+        subject { m_output.tcp_send(multival_event) }
+        it "should return true" do
+          expect(subject).to eq(true)
+        end
+      end
+
+    end # "#tcp_send", :integration => true
 
     describe "#send_to_zabbix", :integration => true do
+      let(:port) { @zabbix.container.rport(ZABBIX_PORT) }
+      let(:host) { @zabbix.ip }
+
       context "when an event is sent successfully" do
         subject { output.send_to_zabbix(string_event) }
         it "should return true" do
@@ -298,8 +295,8 @@ describe LogStash::Outputs::Zabbix do
         end
       end
 
-    end
+    end # "#send_to_zabbix", :integration => true
 
-  end
+  end # "Integration Tests", :integration => true
 
-end
+end # describe LogStash::Outputs::Zabbix