07. 02. 2018 Juergen Vigna Log Management, Log-SIEM, NetEye

Harmonize Your Monitoring with Your Elasticsearch Database Entries

If you have an Elasticsearch Database like the one in the NetEye Elastic Stack Module then you are surely interested in integrating this information into your Monitoring environment.  To do this, use this new plugin:

check_elasticsearch_query

# /data/neteye/usr/lib/nagios/plugins/local/check_elasticsearch_query --help
Check a count of number of events fount in elasticsearch over a query and timeframe
Usage:  [-H ] [-p ] -q  [-t ] [-w ] [-c ]
  -h, --help    : this help
  -V, --version : program version
  -H, --host    : host/address of elasticsearch (default: localhost)
  -p, --port    : tcp port of elasticsearch (default: 9200)
  -i, --index   : elasticsearch index name (default: logstash-*)
  -q, --query   : elasticsearch query string
  -t, --time    : timeframe for search from now back f.ex. 1h or 1d (default: 1h)
  -w, --warning : warning count  (default: not checked)
  -c, --critical: critical count (default: not checked)

check_elasticsearch_query -  - Copyright Juergen Vigna - Wuerth Phoenix srl.

This Monitoring plugin comes with no warranty. You can use and distribute it
under terms of the GNU General Public License Version 2 (GPL V2) or later.

Construct your filter with your Elasticsearch frontend (e.g., Kibana) and then use this filter to find entries in your Elasticsearch Database.  Here’s an example of what you can do:

/usr/lib/nagios/plugins/check_elasticsearch_query -q "host_group: Network AND facility: OSPF" -t "24h" -w 1 -c 16

This filter will sound the alarm if it finds more than a certain number of warning/critical entries in the selected time frame.  The output also contains performance data, so you can see in your performance analysis when and how often entries occur.

Enjoy monitoring your Elasticsearch Database!

Juergen Vigna

Juergen Vigna

NetEye Solution Architect at Würth Phoenix
I have over 20 years of experience in the IT branch. After first experiences in the field of software development for public transport companies, I finally decided to join the young and growing team of Würth Phoenix. Initially, I was responsible for the internal Linux/Unix infrastructure and the management of CVS software. Afterwards, my main challenge was to establish the meanwhile well-known IT System Management Solution WÜRTHPHOENIX NetEye. As a Product Manager I started building NetEye from scratch, analyzing existing open source models, extending and finally joining them into one single powerful solution. After that, my job turned into a passion: Constant developments, customer installations and support became a matter of personal. Today I use my knowledge as a NetEye Senior Consultant as well as NetEye Solution Architect at Würth Phoenix.

Author

Juergen Vigna

I have over 20 years of experience in the IT branch. After first experiences in the field of software development for public transport companies, I finally decided to join the young and growing team of Würth Phoenix. Initially, I was responsible for the internal Linux/Unix infrastructure and the management of CVS software. Afterwards, my main challenge was to establish the meanwhile well-known IT System Management Solution WÜRTHPHOENIX NetEye. As a Product Manager I started building NetEye from scratch, analyzing existing open source models, extending and finally joining them into one single powerful solution. After that, my job turned into a passion: Constant developments, customer installations and support became a matter of personal. Today I use my knowledge as a NetEye Senior Consultant as well as NetEye Solution Architect at Würth Phoenix.

Leave a Reply

Your email address will not be published. Required fields are marked *

Archive