nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Logstash - OpsGenie Integration

Keorapetse Naane

Hi all

I have configured logstash-opsgenie integration as per documentation at : https://docs.opsgenie.com/docs/logstash-integration

after restarting logstash, I get the below

[2019-03-11T11:18:57,780][WARN ][logstash.outputs.opsgenie] No opsgenie action defined
[2019-03-11T11:18:57,780][INFO ][logstash.outputs.opsgenie] processing 2019-03-11T11:17:28.262Z host1 %{message}
[2019-03-11T11:18:57,780][WARN ][logstash.outputs.opsgenie] No opsgenie action defined
[2019-03-11T11:18:57,780][INFO ][logstash.outputs.opsgenie] processing 2019-03-11T11:17:16.941Z host1 %{message}

This is my alert config under filter plugin

if [message] =~ /.*InfluxDB.*/ {
mutate{
add_field => {
"opsgenieAction" => "create"
"alias" => "influxDB"
"description" => "influx error messages"
"tags" => "influxdb"
}
}
}

And the output :

output {
opsgenie {
"apiKey" => "logstash_integration_api_key"
}
}

replaced logstash_integration_api_key with opsgenie key

Am i missing something?

I thought this(below) is defining an action, to create the alert.

add_field => {
"opsgenieAction" => "create"
Please advise.

Accepted answers

Keorapetse Naane

So I filtered on the logstash side, i put an if condition on the output.

I tag all alerts and filter with that tag on the output. Works great.

We are still on a free version so the number of requests to the api are limited.

I will consider filtering on opsgenie once we purchase one of the paid plans.

All comments

Samir

Hi @Keorapetse Naane - my first instinct would be that it is not matching the filter you have set:

if [message] =~ /.*InfluxDB.*/

so that's why it's not finding any action. Can you confirm whether this is the case or not?

Samir

if you remove the filter, so it will match everything, do you run into the same error?

Keorapetse Naane

Thanks for the prompt response, when i remove the filter it tries to send all log events to ops genie.

I will try to put an if statement(based on a tag) on the opsgenie output, and tag the events i want sent to opsgenie.

I will let you know if it works.

Samir

You can filter on the Opsgenie side. In the advanced view of the integration. You can add filters in the "Create Alert" actions, so you can configure it to only create Opsgenie alerts when the filter is met.

This way you can have everything sent from Logstash to Opsgenie, and have the filtering occur on the Opsgenie side. Hopefully this helps.

Keorapetse Naane

So I filtered on the logstash side, i put an if condition on the output.

I tag all alerts and filter with that tag on the output. Works great.

We are still on a free version so the number of requests to the api are limited.

I will consider filtering on opsgenie once we purchase one of the paid plans.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Unanswered
Groups
Help

Find more posts tagged with

opsgenie

logstash