Elasticsearch

The zabbix output is used for sending item data to zabbix via the zabbix_sender executable.

For this output to work, your event must have the following fields:

In Zabbix, create your host with the same name (no spaces in the name of the host supported) and create your item with the specified key as a Zabbix Trapper item. Also you need to set field that will be send to zabbix as item.value, otherwise @message will be sent.

The easiest way to use this output is with the grep filter. Presumably, you only want certain events matching a given pattern to send events to zabbix, so use grep or grok to match and also to add the required fields.

 filter {
   grep {
     type => "linux-syslog"
     match => [ "@message", "(error|ERROR|CRITICAL)" ]
     add_tag => [ "zabbix-sender" ]
     add_field => [
       "zabbix_host", "%{source_host}",
       "zabbix_item", "item.key"
       "send_field", "field_name"
     ]
  }
   grok {
     match => [ "message", "%{SYSLOGBASE} %{DATA:data}" ]
     add_tag => [ "zabbix-sender" ]
     add_field => [
       "zabbix_host", "%{source_host}",
       "zabbix_item", "item.key",
       "send_field", "data"
     ]
  }
}

output {
  zabbix {
    # only process events with this tag
    tags => "zabbix-sender"

# specify the hostname or ip of your zabbix server
# (defaults to localhost)
host => "localhost"

# specify the port to connect to (default 10051)
port => "10051"

    # specify the path to zabbix_sender
    # (defaults to "/usr/local/bin/zabbix_sender")
    zabbix_sender => "/usr/local/bin/zabbix_sender"
  }
}

zabbix {
}