How to use Icinga2 for notification?

(Denny Fuchs) #1


I tought it should be pretty easy to add “something” which will alerts is via Icinga2, if something found in the log files from Graylog.
The most things is to monitoring Graylog itself, but instead if reading plain logfiles, I want, that either Graylog informs Icinga2, or Icinga2 is able to read Graylog streams and send out notifications. I only found a Plugin for Icinga2, which is from 2016 that is able to read streams …
My hope was to use the HTTP callback … but that sends only a hardcoded JSON … so also not usefull …

Any suggestions ?

(Ivan Punko) #2

you can add your special command that will be fired as soon as Icinga will hae some host down/up and/or services in critical, warning or ok states.
Take a look at this section:

(Michael Friedrich) #3 doesn’t work?

(Denny Fuchs) #4


I’ve found that plugin too, but last commit was 2 years ago so I wasn’t sure, if it is still working … tried it anyway:

./check-graylog2-stream  -stream=11223344566aabbccddee -user=monitoring -password="secret" -url=''
UNKNOWN: Can not parse JSON from Graylog2 API

Curl works:

curl -i --user monitoring:secret -H 'Accept: application/json' ''
HTTP/1.1 200 OK
X-Graylog-Node-ID: f2998e95-dbac-4d3e-af71-213aeb18035b
X-Runtime-Microseconds: 136133
Content-Type: application/json
Date: Mon, 29 Oct 2018 10:31:20 GMT
Content-Length: 1335

  "total" : 1,
  "streams" : [ {
    "id" : "11223344566aabbccddee",
    "creator_user_id" : "foobar",
    "outputs" : [ ],
  [<removed rest>]
  } ]
(Denny Fuchs) #5


thanks for the reply, but I’m asking for: if Graylogs logs something which requires things to do, like sending a notification FROM Graylog TO Icinga2 :slight_smile:

(Michael Friedrich) #6

Seems to be a different API version, last time I’ve checked it was Graylog 2.4.

Anyhow, since you’ve been asking about such an output, I remembered that there’s a first version from a customer sponsored plugin around. You might try that:

(Denny Fuchs) #7

hi @dnsmichi,

awesome ! it works exactly that we want :slight_smile: I have only one thing … they have to use a satellite and I use also the “create object” function.
I think, its not possible to create a service object via satellite on the master ?

(Michael Friedrich) #8

It will only exist locally, but not synced to the master.

(Denny Fuchs) #9


that confirms my problem :slight_smile: The satellite config is then “wrong” and can’t reload for changes from the master. So I assume, I have to disable this option and create them by hand / director.