Change Zabbix alerter

CHANGELOG.md

@@ -19,6 +19,7 @@
 - [MS Teams] Add arbitrary text value support for Facts - [#790](https://github.com/jertel/elastalert2/pull/790) - @iamxeph
 - [MS Teams] Use alert_subject as ms_teams_alert_summary if ms_teams_alert_summary is not set - [#802](https://github.com/jertel/elastalert2/pull/802) - @iamxeph
 - [Mattermost] List support for mattermost_channel_override - [#809](https://github.com/jertel/elastalert2/pull/809) - @nsano-rururu
+- [Zabbix] Add the ability to specify `zbx_host` from available elasticsearch field - [#820](https://github.com/jertel/elastalert2/pull/820) - @timeforplanb123
 
 ## Other changes
 - [Docs] Update FAQ ssl_show_warn - [#764](https://github.com/jertel/elastalert2/pull/764) - @nsano-rururu

docs/source/ruletypes.rst

@@ -3324,6 +3324,8 @@ Required:
 
 ``zbx_sender_port``: The port where zabbix server is listenning, defaults to ``10051``.
 
+``zbx_host_from_field``: This field allows to specify ``zbx_host`` value from the available terms. Defaults to ``False``.
+
 ``zbx_host``: This field setup the host in zabbix that receives the value sent by ElastAlert 2.
 
 ``zbx_key``: This field setup the key in the host that receives the value sent by ElastAlert 2.
@@ -3336,3 +3338,17 @@ Example usage::
     zbx_sender_port: 10051
     zbx_host: "test001"
     zbx_key: "sender_load1"
+
+To specify ``zbx_host`` depending on the available elasticsearch field, zabbix alerter has ``zbx_host_from_field`` option.
+
+Example usage::
+
+    alert:
+      - "zabbix"
+    zbx_sender_host: "zabbix-server"
+    zbx_sender_port: 10051
+    zbx_host_from_field: True 
+    zbx_host: "hostname"
+    zbx_key: "sender_load1"
+
+where ``hostname`` is the available elasticsearch field.

elastalert/alerters/zabbix.py

@@ -3,7 +3,7 @@
 from pyzabbix import ZabbixSender, ZabbixMetric, ZabbixAPI
 
 from elastalert.alerts import Alerter
-from elastalert.util import elastalert_logger, EAException
+from elastalert.util import elastalert_logger, lookup_es_key, EAException
 
 
 class ZabbixClient(ZabbixAPI):
@@ -53,6 +53,7 @@ def __init__(self, *args):
 
         self.zbx_sender_host = self.rule.get('zbx_sender_host', 'localhost')
         self.zbx_sender_port = self.rule.get('zbx_sender_port', 10051)
+        self.zbx_host_from_field = self.rule.get('zbx_host_from_field', False)
         self.zbx_host = self.rule.get('zbx_host', None)
         self.zbx_key = self.rule.get('zbx_key', None)
         self.timestamp_field = self.rule.get('timestamp_field', '@timestamp')
@@ -76,15 +77,24 @@ def alert(self, matches):
                 except ValueError:
                     ts_epoch = int(datetime.strptime(match[self.timestamp_field], '%Y-%m-%dT%H:%M:%S%z')
                                    .timestamp())
-            zm.append(ZabbixMetric(host=self.zbx_host, key=self.zbx_key, value='1', clock=ts_epoch))
+            if self.zbx_host_from_field:
+                zbx_host = lookup_es_key(match, self.rule["zbx_host"])
+            else:
+                zbx_host = self.zbx_host
+            zm.append(ZabbixMetric(host=zbx_host, key=self.zbx_key, value='1', clock=ts_epoch))
 
         try:
             response = ZabbixSender(zabbix_server=self.zbx_sender_host, zabbix_port=self.zbx_sender_port).send(zm)
             if response.failed:
-                elastalert_logger.warning("Missing zabbix host '%s' or host's item '%s', alert will be discarded"
-                                          % (self.zbx_host, self.zbx_key))
+                if self.zbx_host_from_field and not zbx_host:
+                    elastalert_logger.warning("Missing term '%s' or host's item '%s', alert will be discarded"
+                                              % (self.zbx_host, self.zbx_key))
+                else:
+                    elastalert_logger.warning("Missing zabbix host '%s' or host's item '%s', alert will be discarded"
+                                              % (zbx_host, self.zbx_key))
             else:
-                elastalert_logger.info("Alert sent to Zabbix")
+                elastalert_logger.info("Alert sent to '%s:%s' zabbix server, '%s' zabbix host, '%s' zabbix host key"
+                                       % (self.zbx_sender_host, self.zbx_sender_port, zbx_host, self.zbx_key))
         except Exception as e:
             raise EAException("Error sending alert to Zabbix: %s" % e)
 

elastalert/schema.yaml

@@ -688,5 +688,6 @@ properties:
   ### Zabbix
   zbx_sender_host: {type: string}
   zbx_sender_port: {type: integer}
+  zbx_host_from_field: {type: boolean}
   zbx_host: {type: string}
   zbx_key: {type: string}

tests/alerters/zabbix_test.py

@@ -41,6 +41,57 @@ def test_zabbix_basic(caplog):
         assert ('elastalert', logging.WARNING, log_messeage) == caplog.record_tuples[0]
 
 
+@pytest.mark.parametrize('zbx_host_from_field, zbx_host, zbx_key, log_messeage', [
+        (True, 'hostname', 'example-key',
+         "Missing zabbix host 'example.com' or host's item 'example-key', alert will be discarded"),
+        (True, 'unavailable_field', 'example-key',
+         "Missing term 'unavailable_field' or host's item 'example-key', alert will be discarded"),
+        (False, 'hostname', 'example-key',
+         "Missing zabbix host 'hostname' or host's item 'example-key', alert will be discarded"),
+        (False, 'unavailable_field', 'example-key',
+         "Missing zabbix host 'unavailable_field' or host's item 'example-key', alert will be discarded")
+])
+def test_zabbix_enhanced(caplog, zbx_host_from_field, zbx_host, zbx_key, log_messeage):
+    caplog.set_level(logging.WARNING)
+    rule = {
+        'name': 'Enhanced Zabbix test',
+        'type': 'any',
+        'alert_text_type': 'alert_text_only',
+        'alert': [],
+        'alert_subject': 'Test Zabbix',
+        'zbx_host_from_field': zbx_host_from_field,
+        'zbx_host': zbx_host,
+        'zbx_key': zbx_key
+    }
+    rules_loader = FileRulesLoader({})
+    rules_loader.load_modules(rule)
+    alert = ZabbixAlerter(rule)
+    match = {
+        '@timestamp': '2021-01-01T00:00:00Z',
+        'somefield': 'foobarbaz',
+        'hostname': 'example.com'
+    }
+    with mock.patch('pyzabbix.ZabbixSender.send') as mock_zbx_send:
+        alert.alert([match])
+
+        hosts = {
+            (True, 'hostname'): 'example.com',
+            (True, 'unavailable_field'): 'None',
+            (False, 'hostname'): 'hostname',
+            (False, 'unavailable_field'): 'unavailable_field'
+        }
+
+        zabbix_metrics = {
+            'host': hosts[(zbx_host_from_field, zbx_host)],
+            'key': 'example-key',
+            'value': '1',
+            'clock': 1609459200
+        }
+        alerter_args = mock_zbx_send.call_args.args
+        assert vars(alerter_args[0][0]) == zabbix_metrics
+        assert ('elastalert', logging.WARNING, log_messeage) == caplog.record_tuples[0]
+
+
 def test_zabbix_getinfo():
     rule = {
         'name': 'Basic Zabbix test',