Logstash Integration

Logstash is a data pipeline that helps you process logs and other event data from a variety of systems. With plugins, Logstash can connect to a variety of sources and stream data at scale to a central analytics system.

288

​What does Opsgenie offer Logstash users?

Logstash sends event information via output plugins. With Opsgenie's Logstash Integration, Opsgenie acts as a dispatcher for these events, determines the right people to notify based on on-call schedules– notifies via email, text messages (SMS), phone calls, and iPhone & Android push notifications, and escalates alerts until the alert is acknowledged or closed.

Functionality of the integration

According to Logstash events:

  • Alert is created in Opsgenie.
  • Designated alert is acknowledged.
  • Note is added to designated alert.
  • Designated alert is closed.

Add Logstash Integration in Opsgenie

  1. Please create an Opsgenie account if you haven't done so already
  2. Go to Opsgenie Logstash Integration page.

🚧

For Essentials plan, you can only add the integrations from the Team Dashboards, please use the alternative instructions given below to add this integration.

  1. Specify who is notified for Logstash alerts using the Teams field. Auto-complete suggestions are provided as you type.

📘

An alternative for Step 2) and Step 3) is to add the integration from the Team Dashboard of the team which will own the integration. To add an integration directly to a team, navigate to the Team Dashboard and open Integrations tab. Click Add Integration and select the integration that you would like to add.

  1. Copy the API Key.
  2. Click Save Integration.
1124

Configuration on Logstash

  1. Logstash Opsgenie Output plugin is available in RubyGems.org. Install the plugin by running
  • Logstash 5.4+: bin/logstash-plugin install logstash-output-opsgenie
  • Other Versions: bin/plugin install logstash-output-opsgenie
  1. Add the following configuration to the configuration file and populate "apiKey" field with the Logstash Integration API Key.
output {
    opsgenie {
        "apiKey" => "logstash_integration_api_key"
    }
}
  1. Opsgenie Output Plugin expects that events contain a field called "opsgenieAction". Also, Opsgenie expects the data in a certain structure, so some additional fields are added to the event. To add fields, use a filter plugin like Mutate, Grok etc. To get more information about the fields added to events and what they mean, please refer to inline code documentation of the plugin.

An example Mutate filter enhanced with Ruby filter plugin configuration is shown below:

filter {
  mutate{
    add_field => {
        "opsgenieAction" => "create"
        "alias" => "neo123"
        "description" => "Every alert needs a description"
        "actions" => ["Restart", "AnExampleAction"]
	"tags" => ["OverwriteQuietHours","Critical"]
	"[details][prop1]"=> "val1"
        "[details][prop2]" => "val2"
        "entity" => "An example entity"
        "priority" => "P4"
	"source" => "custom source"
	"user" => "custom user"
	"note" => "alert is created"
        }
    }
    ruby {
 	 code => "event.set('teams', [{'name' => 'Integration'}, {'name' => 'Platform'}])"
    }
}
  1. Run Logstash.

The source for the plugin is available at GitHub