Using available terms in zabbix rule type

[timeforplanb123]

Hi!
I will be very glad, if someone helps me with a question:
i use zabbix alerter and frequency rule:

alert:
- "zabbix"
zbx_sender_host: "zabbix_server_ip"
zbx_sender_port: 10051
zbx_host: hostname
zbx_key: "zabbix_host_item"

How can I send an alert depending on the hostname term and How can i use available terms values in zbx_host field? If i use hostname, it doesn't work.

elastalert-test-rule  --config elastalert2/examples/config.yaml.example  elastalert2/examples/rules/zabbix_frequency.yaml

INFO:elastalert:Note: In debug mode, alerts will be logged to console but NOT actually sent.
            To send them but remain verbose, use --verbose instead.
Got 47 hits from the last 0 day

Available terms in first hit:
	@version
	severity
	message
	host
	type
	hostname
	time
	moduleName
	@timestamp

INFO:elastalert:Note: In debug mode, alerts will be logged to console but NOT actually sent.
                To send them but remain verbose, use --verbose instead.
INFO:elastalert:1 rules loaded
INFO:apscheduler.scheduler:Adding job tentatively -- it will be properly scheduled when the scheduler starts
INFO:elastalert:Queried rule zabbix frequency rule from 2022-04-11 10:53 to 2022-04-11 10:58 : 1 / 1 hits
INFO:elastalert:Alert for zabbix frequency rule at 2022-04-11T07:54:57.155Z:
INFO:elastalert:zabbix frequency rule

At least 1 events occurred between 2022-04-11 10:49 and 2022-04-11 10:54

@timestamp: 2022-04-11T07:54:57.155Z
@version: 1
_id: ...
_index: ...-2022-04-11
_type: _doc
host: ...
hostname: some_hostname
message: some_message
num_hits: 1
num_matches: 1
severity: ...
time: Apr 11 2022 07:54:57
type: syslog

...

And after rule running:

elastalert --verbose --config elastalert2/examples/config.yaml.example --rule elastalert2/examples/rules/zabbix_frequency.yaml

WARNING:elastalert:Missing zabbix host 'hostname' or host's item 'zabbix_host_item', alert will be discarded
INFO:elastalert:Ignoring match for silenced rule zabbix frequency rule
INFO:elastalert:Ran storm detection frequency rule from 2022-04-11 14:51 to 2022-04-11 15:09: 0 query hits (0 already seen), 2 matches, 1 alerts sent

Zabbix host has item zabbix_host_item, and if i specify the hostname manually, then everything works good.
Thanks a lot for help, in advance!

[nsano-rururu]

I don't understand the whole rule, so I find it difficult to answer what the problem is.
#11

[timeforplanb123]

Sorry for unclear question.

My task is very simple. I have ~500 hosts in zabbix. I need to send "1" to the zabbix item of each of these hosts, when the elastalert2 frequency rule is triggered (now this is a simple rule that works every time, when a syslog message appears in elasticsearch).

The name of each such host is stored in the elasticsearch hostname field. But, how do I specify the name of each host in zbx_host?

When i use this syntax:

alert:
- "zabbix"
zbx_sender_host: "192.168.0.1"
zbx_sender_port: 10051
zbx_host: hostname
# each zabbix host has zabbix_host_item
zbx_key: "zabbix_host_item"

i get warning:

WARNING:elastalert:Missing zabbix host 'hostname' or host's item 'zabbix_host_item', alert will be discarded

But everything works fine, when I specify the zbx_host manually, for example, for some one zabbix host...

[SysAdmLS]

elastalert2/elastalert/alerters/zabbix.py

Line 56 in cc3e5d0

self.zbx_host = self.rule.get('zbx_host', None)

Seems like the zbx_host is read from the rule file statically. You would have to implement that yourself. I could be wrong tho.

[timeforplanb123]

Yep! You're right. Created PR #820 to add new ability