Need to get the message/log details in Iciniga check

[sabil05]

Hello Team,

Thank you so much for creating a wonderful documentation on Icinga integration with ELK. By referring the document I am able to integrate Icinga with ELK.

I am using iclingacli-elasticsearch check_command to see the events in Icinga.

I have couple of questions on this integration. Would be really helpful if you can assist/help in this regards.

• I am not able to see the Event details in Event Overview section. (I am just getting the Event count using icingacli command)
• I just wanted to know is there a way to get the Event details using Icingacli command such as entire message information of a log, As we currently has --filter option something like that.

Following is the configuration i have defined in service.conf file and I am looking for the events which has 404 HTTP status code in message section of logs. I just wanted to is there a way to get entire log message as well as apply filters on it.

apply Service "icingacli-elasticsearch" {
  import "generic-service"
  check_command = "icingacli-elasticsearch"
  vars.icingacli_elasticsearch_instance = "Elasticsearch"
  vars.icingacli_elasticsearch_critical = 1
  vars.icingacli_elasticsearch_warning = 1
  vars.icingacli_elasticsearch_index = "filebeat-*"
  vars.icingacli_elasticsearch_filter = "message=404"
  vars.icingacli_elasticsearch_from = "-5m"
  display_name = "HTTP status and code"
  assign where host.vars.instance_type == "elkhost"
  notes = "Messages contains GET and 200 HTTP status code"
}

Kindly assist me to getting event details in the icinga to have more information about the events.

Thank you so much in advance! Sabil.

Your Environment

• Module version (Elasticsearch):
• Icinga Web 2 version and modules (System - About): Icingaweb2
• Icinga 2 version (icinga2 --version): icinga2 - The Icinga 2 network monitoring daemon (version: r2.11.2-1)
• Elasticsearch version (curl http://localhost:9200):
• Operating System and version: 20.04.3 LTS (Focal Fossa)
• Webserver, PHP versions:

[sabil05]

Hello Team,

I also wanted to is there a possibility to do customization with icingacli command. As I have to get the more information using single check.

Kindly suggest.

Thanks.