Search found 49 matches

by xdatanet
Thu Mar 27, 2025 9:29 am
Forum: Nagios Log Server
Topic: Cannot order a date in EventTime
Replies: 3
Views: 5586

Cannot order a date in EventTime

I import al log from an application by nxlog using a filter: if [type] == 'MyProgram_Requests' { date { match => [ 'mp-date', 'M/d/yyyy hh:mm:ss a' ] target => 'EventTime' } } It works like a charm. @timestamp 2025-03-27T01:01:45.550+01:00 mp-date 3/26/2025 11:48:07 PM EventTime 2025-03-26T23:48:07....
by xdatanet
Wed Feb 12, 2025 10:11 am
Forum: Nagios Log Server
Topic: About filters...
Replies: 9
Views: 270021

Re: About filters...

kg2857 wrote: Fri Feb 07, 2025 7:49 pm If the current cluster has multiple hosts as it should, you should be sending logs to a VIP, so adding new hosts shouldn't be much of an issue.
It was worse than it looked... :lol:

Graziano.
by xdatanet
Fri Feb 07, 2025 9:14 am
Forum: Nagios Log Server
Topic: About filters...
Replies: 9
Views: 270021

Re: About filters...

Sorry, what was unclear about my question? Do I need to upgrade my actual 2024R1.3 nodes to 2024R2 like previous update from 1.2 or do I need to redeploy another cluster with the new version and then migrate the data to it??? Because if I had to deploy another cluster there would be many many work t...
by xdatanet
Thu Feb 06, 2025 9:02 am
Forum: Nagios Log Server
Topic: About filters...
Replies: 9
Views: 270021

Re: About filters...

Jason,
just a question about the 2024R2.

I hope I didn't understand correctly the webinar. Have I to reinstall a fresh new 2024R2 version and then migrate all my data or can I upgrade from 1.3 to 2??

Regards,
Graziano.
by xdatanet
Wed Feb 05, 2025 11:22 am
Forum: Nagios Log Server
Topic: About filters...
Replies: 9
Views: 270021

Re: About filters...

I solved.

The problem is that I'm searching a string in place of a number (integer).

if [EventID] == 1717 without '' works.

Another question. Why Logstash plugins in NagiosLS are at 2.0.3 version?

I'd need mutate => copy but it was introduced in 3.1.5 plugin version.

Regards,
Graziano.
by xdatanet
Wed Feb 05, 2025 10:47 am
Forum: Nagios Log Server
Topic: About filters...
Replies: 9
Views: 270021

About filters...

I'm trying to use filters. I have some inputs that sets [type] value or [tags] value... The Nagios sample refers to [program]: if [program] == 'apache_access' { [...] I would to filter event ID and write a filter like this: if [EventID] == '1234' do some grok, mutate,... but this does not work! If I...
by xdatanet
Thu Nov 28, 2024 8:57 am
Forum: Nagios Log Server
Topic: Create a terms with field "message" in a dashboard
Replies: 2
Views: 6152

Create a terms with field "message" in a dashboard

I receive an Event Log from Windows with a HostName in message field like "NBADM01" or "NBUSR02". I'm trying to create a row with a "terms" table in order to count the total of HostName and fill in a bar-like graph. If I put "message" in field I can view a bar...
by xdatanet
Mon Oct 07, 2024 5:30 am
Forum: Nagios Log Server
Topic: How to monitor NagiosLS from NagiosXI
Replies: 11
Views: 33992

Re: How to monitor NagiosLS from NagiosXI

Solved!!!

Ubuntu uses bash not sh...

I changed /bin/sh to /bin/bash in ncpa.cfg and it works.

Regards,
Graziano.
by xdatanet
Mon Oct 07, 2024 5:10 am
Forum: Nagios Log Server
Topic: How to monitor NagiosLS from NagiosXI
Replies: 11
Views: 33992

Re: How to monitor NagiosLS from NagiosXI

I've found check_es_cluster_status.sh into ncpa/plugins folder of my NagiosLS. If I run it, it works. OK: Cluster status is GREEN But if I call it from NagiosXI it returns: /usr/local/ncpa/plugins/check_es_cluster_status.sh: 1: python2: not found UNKNOWN: could not retrieve cluster health data I thi...
by xdatanet
Mon Oct 07, 2024 1:30 am
Forum: Nagios Log Server
Topic: How to monitor NagiosLS from NagiosXI
Replies: 11
Views: 33992

How to monitor NagiosLS from NagiosXI

I already monitor my two nodes by ncpa from NagiosXI (CPU, MEM, Port, eth, disks). I want to monitor the state of the cluster because sometimes my VPN goes down and the cluster stops to syncronize. I found a sh script in the template site that check it by the 9200 port but this port is open only to ...