This repository was archived by the owner on Apr 25, 2019. It is now read-only.
This repository was archived by the owner on Apr 25, 2019. It is now read-only.
process-check-result Error: broken pipe #10
Description
Hi,
im trying to modify a check-result with logstash.
I have a Host with filebeat, that is sending new logfile entries to Logstash on another host.
That works perfectly fine.
Now I want to filter the incoming message from filebeat and output it to icinga.
But I get the following message when Logstash tries to send the data to icinga:
[WARN ][logstash.outputs.icinga ] Request failed {:host=>"localhost", :port=>5665, :path=>"/v1/actions/process-check-result?service=linArpalertVM%21testService", :body=>"{\"exit_status\":\"1\",\"plugin_output\":\"Placeholder\"}", :error=>#<IOError: Broken pipe>}
my Icinga api_users.conf config is:
object ApiUser "root" {
password = "password"
//client_cn = ""
permissions = [ "*" ]
}
object ApiUser "icinga" {
password = "icinga"
//client_cn = ""
permissions = [ "*" ]
}
apply Service "testService" {
import "generic-service"
check_command = "dummy"
assign where host.address
}
and my Logstash config looks like the following:
input {
beats {
port => 5044
type => "logs"
}
}
filter {
if "new_mac" in [message] {
mutate {
replace => { "exit_status" => "2" }
}
}
}
output {
icinga {
host => 'localhost'
user => 'icinga'
password => 'icinga'
ssl_verify => false
action => 'process-check-result'
action_config => {
exit_status => "%{exit_status}"
plugin_output => "Placeholder"
}
icinga_host => "linArpalertVM"
icinga_service => "testService"
}
stdout { }
}
The command works fine when I enter it manually with curl:
curl -k -u icinga:icinga -H 'Accept: application/json' -X POST 'https://localhost:5665/v1/actions/process-check-result?service=linArpalertVM%21testService' -d "{\"exit_status\":\"1\",\"plugin_output\":\"Placeholder\"}"
If you need any more file content let me now...
I searched almost a week now in the internet but nothing helped...