When Zabbix is connected to Elasticsearch, latest data are not working

[limosek]

When Zabbix is connected to elasticsearch as backend, it does not return as many information as from SQL. And zabbixctl dies.

Trace from standard installation: [TRACE] <~ { "jsonrpc": "2.0", "result": [ { "itemid": "54273", "clock": "1546513053", "value": "1", "ns": "491346373" } ], "id": 10 }

trace from elk installation: { "itemid": "86196", "type": "7", "snmp_community": "", "snmp_oid": "", "hostid": "10267", "name": "Server log file messages for IP 10.29.10.157", "key_": "log[(ERROR).*10.29.10.157]", "delay": "1h", "history": "90d", "trends": "0", "status": "0", "value_type": "2", "trapper_hosts": "", "units": "", "snmpv3_securityname": "", "snmpv3_securitylevel": "0", "snmpv3_authpassphrase": "", "snmpv3_privpassphrase": "", "formula": "", "error": "", "lastlogsize": "2343015", "logtimefmt": "", "templateid": "0", "valuemapid": "0", "params": "", "ipmi_sensor": "", "authtype": "0", "username": "", "password": "", "publickey": "", "privatekey": "", "mtime": "0", "flags": "4", "interfaceid": "0", "port": "", "description": "", "inventory_link": "0", "lifetime": "30d", "snmpv3_authprotocol": "0", "snmpv3_privprotocol": "0", "state": "0", "snmpv3_contextname": "", "evaltype": "0", "jmx_endpoint": "", "master_itemid": "0", "timeout": "3s", "url": "", "query_fields": [], "posts": "", "status_codes": "200", "follow_redirects": "1", "post_type": "0", "http_proxy": "", "headers": [], "retrieve_mode": "0", "request_method": "1", "output_format": "0", "ssl_cert_file": "", "ssl_key_file": "", "ssl_key_password": "", "verify_peer": "0", "verify_host": "0", "allow_traps": "0", "lastclock": "0", "lastns": "0", "lastvalue": "", "prevvalue": "" } Produced error: can't obtain history for items of triggers └─ can't obtain items of triggers └─ json: cannot unmarshal number into Go struct field Item.lastclock of type string

[kovetskiy]

Hi, currently I'm not working with zabbix environments so I can't check your issue, but I will be glad to merge a PR with the fix.

[limosek]

Sorry but I am not js programmer. It is hard for me to understand code or make changes. I think that you need to change interpretation of lastclock. So if is not string or "0" , ignore it? Not sure. If you need some more debugging outputs, I can offer to you. Thank you!

[kovetskiy]

@limosek can you please run zabbixctl with --trace flag and share it? It may contain sensitive information, so please double check it. You can also share it to my email: e.kovetskiy at gmail.com.

[limosek]

Sent to your email. Thnx

[kovetskiy]

@limosek Yep, just found the underlying reason why it can't unmarshal. Historically, zabbix returns numbers as strings (in quotes), so zabbixctl expects strings, but timestamps in ELK are numbers, so zabbix returned them as float64. I've fixed it, please try last commit. (You might need to run go get in the repository and then make build)

[limosek]

Just tried. Got same results. Including part of trace. It seems that lastclock is string and it is "0". "verify_host": "0", "allow_traps": "0", "lastclock": "0", "lastns": "0", "lastvalue": "", "prevvalue": "" } ], "id": 2 } can't obtain zabbix items └─ json: cannot unmarshal number into Go struct field Item.lastclock of type string

[kovetskiy]

@limosek that's really weird, can you please double-check that you have pulled master and run make build and then called ./zabbixctl? What zabbixctl --version tells you?

[limosek]

I really do know nothing about go ;) ./zabbixctl --version manual build

I did go get github.com/kovetskiy/zabbixctl

Not sure how to force make build.