Event Forwarder
The Event Forwarder (formerly known as the Elasticsearch REST plugin) forwards events to Elasticsearch. The events in Elasticsearch can then be used for indexing, long-time archival, plotting with Grafana, and browsing with Kibana.
If you use Kibana, make sure you are using the version that is compatible with your version of Elasticsearch. |
Configuration
The configuration is held in ${OPENNMS_HOME}/etc/org.opennms.plugin.elasticsearch.rest.forwarder.cfg
.
Please refer to Configuring Elasticsearch for information on how to configure Elasticsearch connection settings.
Besides the general Elasticsearch connection settings, the following properties are supported to configure the Event Forwarder:
Parameter | Description | Default |
---|---|---|
logEventDescription |
Whether to forward the event description field to Elasticsearch. It can be disabled as it contains a long text field that can be redundant with the rest of the metadata included in the event. |
true |
archiveAssetData |
If |
true |
groupOidParameters |
If |
false |
logAllEvents |
If changed to |
false |
batchSize |
Increase this value to enable batch inserts into Elasticsearch. This is the maximum size of a batch of events that is sent to Elasticsearch in a single connection. |
200 |
batchInterval |
The maximum time interval in milliseconds between batch events (recommended: 500ms) when using a |
500 |
Once you are sure everything is correctly configured, you can activate the Event Forwarder by logging into the OSGi console and installing the feature: opennms-es-rest
.
ssh admin@localhost -p 8101
karaf> feature:install opennms-es-rest
Loading historical events
It is possible to load historical Horizon events into Elasticsearch from the Horizon database using a Karaf Console command. The command uses the Horizon Events REST interface to retrieve a set number of historical events and forward them to Elasticsearch. Because we are using the REST interface, it is also possible to contact a remote Horizon and download its events into Elasticsearch by using the correct remote URL and credentials.
# open karaf command prompt using
# ssh -p 8101 admin@localhost
karaf> opennms:send-events-to-elasticsearch --username admin --password admin --url http://localhost:8980 --limit 10 --offset 0
For more details, consolidate the --help option of the command.
|
Index definition
The index names used to store the events use the following form: opennms-raw-events-<index-strategy>/type/id
opennms-events-raw-2017-01/eventdata/11549
Viewing events using Kibana Sense
Kibana Sense is a Kibana app that lets you run queries directly against Elasticsearch.
If you install Kibana Sense, you can use the following commands to view the events sent to Elasticsearch. You should review the Elasticsearch REST API documentation to understand how to specify searches.
# Search all the events indexes
GET /opennms-events-*/_search
# Search all the raw events indexes
GET /opennms-events-raw*/_search
# Delete all the events indexes
DELETE /opennms-events-*/
# Get all the raw events indexes
GET /opennms-events-raw*/