F5 - Hardware metrics

logstash conf:

input { exec { codec => multiline { pattern => “EOF” what => “previous” } type => ‘f5-metric-int’ command => ‘snmpget -v2c -Cf -c public xxx.xxx.xxx.xxx -Os sysStatMemoryUsed.0 sysHostMemoryUsed.0 sysStatClientCurConns.0 sysStatServerCurConns.0 sysClientsslStatCurConns.0 sysServersslStatCurConns.0 sysGlobalHostSwapUsed.0 sysGlobalHostSwapTotal.0 sysStatClientBytesIn.0 sysStatClientBytesOut.0 sysStatServerBytesIn.0 sysStatServerBytesOut.0 sysStatHttpRequests.0 sysGlobalHostMemTotal.0 sysGlobalHostCpuUsageRatio5s.0 sysGlobalHostCpuIowait5s.0 sysGlobalHostCpuSoftirq5s.0 sysGlobalHostCpuIrq5s.0 sysGlobalHostCpuIdle5s.0 sysGlobalHostCpuSystem5s.0 sysGlobalHostCpuNice5s.0 sysGlobalHostCpuUser5s.0 | sed s/.0.=.//| sed s/Counter64:// | sed s/Gauge32:// |sed s/sysGlobalHost//|sed s/5s//’ interval => 5 add_field => [ “server”, “xxxxxxx” ] } exec { codec => multiline { pattern => “EOF” what => “previous” } type => ‘f5-metric-ext’ command => ‘snmpget -v2c -Cf -c public xxx.xxx.xxx.xxx -Os sysStatMemoryUsed.0 sysHostMemoryUsed.0 sysStatClientCurConns.0 sysStatServerCurConns.0 sysClientsslStatCurConns.0 sysServersslStatCurConns.0 sysGlobalHostSwapUsed.0 sysGlobalHostSwapTotal.0 sysStatClientBytesIn.0 sysStatClientBytesOut.0 sysStatServerBytesIn.0 sysStatServerBytesOut.0 sysStatHttpRequests.0 sysGlobalHostMemTotal.0 sysGlobalHostCpuUsageRatio5s.0 sysGlobalHostCpuIowait5s.0 sysGlobalHostCpuSoftirq5s.0 sysGlobalHostCpuIrq5s.0 sysGlobalHostCpuIdle5s.0 sysGlobalHostCpuSystem5s.0 sysGlobalHostCpuNice5s.0 sysGlobalHostCpuUser5s.0 | sed s/.0.=.//| sed s/Counter64:// | sed s/Gauge32:// |sed s/sysGlobalHost//|sed s/5s//’ interval => 5 add_field => [ “server”, “xxxx2” ] } exec { codec => multiline { pattern => “EOF” what => “previous” } type => ‘f5-metric-ext’ command => ‘snmpget -v2c -Cf -c public xxx.xxx.xxx.xxx -Os sysStatMemoryUsed.0 sysHostMemoryUsed.0 sysStatClientCurConns.0 sysStatServerCurConns.0 sysClientsslStatCurConns.0 sysServersslStatCurConns.0 sysGlobalHostSwapUsed.0 sysGlobalHostSwapTotal.0 sysStatClientBytesIn.0 sysStatClientBytesOut.0 sysStatServerBytesIn.0 sysStatServerBytesOut.0 sysStatHttpRequests.0 sysGlobalHostMemTotal.0 sysGlobalHostCpuUsageRatio5s.0 sysGlobalHostCpuIowait5s.0 sysGlobalHostCpuSoftirq5s.0 sysGlobalHostCpuIrq5s.0 sysGlobalHostCpuIdle5s.0 sysGlobalHostCpuSystem5s.0 sysGlobalHostCpuNice5s.0 sysGlobalHostCpuUser5s.0 | sed s/.0.=.//| sed s/Counter64:// | sed s/Gauge32:// |sed s/sysGlobalHost//|sed s/5s//’ interval => 5 add_field => [ “server”, “xxxx3” ] }

} filter { if [type] == “f5-metric-int” or [type] == “f5-metric-ext” { grok { match => { “message” => “%{DATA:parameter} %{NUMBER:value:int}” } }

mutate {
  add_field => [ "%{parameter}","%{value}" ]
  convert => [ "%{parameter}", "integer" ]
}
mutate {
    convert => [ "CpuUser", "integer"]
    convert => [ "CpuNice", "integer"]
    convert => [ "CpuSystem", "integer"]
    convert => [ "CpuIdle", "integer"]
    convert => [ "CpuIrq", "integer"]
    convert => [ "CpuSoftirq", "integer"]
    convert => [ "CpuIowait", "integer"]
    convert => [ "CpuUsageRatio", "integer"]
    convert => [ "sysStatMemoryUsed", "integer"]
    convert => [ "sysHostMemoryUsed", "integer"]
    convert => [ "sysStatClientCurConns", "integer"]
    convert => [ "sysStatServerCurConns", "integer"]
    convert => [ "sysClientsslStatCurConns", "integer"]
    convert => [ "sysServersslStatCurConns", "integer"]
    convert => [ "SwapUsed", "integer"]
    convert => [ "SwapTotal", "integer"]
    convert => [ "sysStatClientBytesIn", "integer"]
    convert => [ "sysStatClientBytesOut", "integer"]
    convert => [ "sysStatServerBytesIn", "integer"]
    convert => [ "sysStatServerBytesOut", "integer"]
    convert => [ "sysStatHttpRequests", "integer"]
    convert => [ "MemTotal", "integer"]
}
mutate {
  remove_field => [ "message" , "parameter", "value", "command" ]
}

date {
  match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
}

} }

output { elasticsearch { hosts => [“xxx.xxx.xxx.xxx:9200”] index => “logstash-f5-metric-%{+YYYY.MM.dd}” } stdout { codec => rubydebug }

}