# events history

**URL:** <https://discourse.sensu.io/t/events-history/477>\
**Category:** Sensu Classic (EOL)\
**Created:** [August 16, 2015, 6:46am UTC](https://discourse.sensu.io/t/events-history/477 "2015-08-16T06:46:26Z")\
**Posts on this page:** 16\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yossi\_Nachum](https://avatars.discourse-cdn.com/v4/letter/y/b9bd4f/32.png) [@Yossi\_Nachum](https://discourse.sensu.io/u/Yossi_Nachum)\
**Post date:** [August 16, 2015, 6:46am UTC](https://discourse.sensu.io/t/events-history/477/1 "2015-08-16T06:46:26Z")

</div>

Hi Guys,

I installed two weeks sensu with uchiwa for my first time.

I am trying to look for old events (what happen last week) and I don’t see any option to get it.

how do you see old events in sensu?

I found only this api [http://localhost:4567/clients/client\_name/history](http://localhost:4567/clients/client_name/history) and I see there only the last execution time and I am looking for events that triggered warning or critical thresholds

Thanks,

Yossi

---

<div class="post-metadata">

**Author:** ![Kyle\_Anderson](https://avatars.discourse-cdn.com/v4/letter/k/e5b9ba/32.png) [@Kyle\_Anderson](https://discourse.sensu.io/u/Kyle_Anderson)\
**Post date:** [August 16, 2015, 4:13pm UTC](https://discourse.sensu.io/t/events-history/477/2 "2015-08-16T16:13:16Z")

</div>

Sensu doesn't have an internal capability to store long term data like  
that, it is more like an event processor.

I'm not aware of an existing sensu extension to store all of the  
historical event data somewhere. (like a sensudb?) But I sure wish  
someone would make one! 🙂  
The only other thing you could use out-of-the-box is the sensu logs.

> **···**
>
> On Sat, Aug 15, 2015 at 11:46 PM, Yossi Nachum \<nachum234@gmail.com\> wrote:
> 
> > Hi Guys,
> > 
> > I installed two weeks sensu with uchiwa for my first time.
> > 
> > I am trying to look for old events (what happen last week) and I don't see  
> > any option to get it.
> > 
> > how do you see old events in sensu?
> > 
> > I found only this api [http://localhost:4567/clients/client\_name/history](http://localhost:4567/clients/client_name/history) and  
> > I see there only the last execution time and I am looking for events that  
> > triggered warning or critical thresholds
> > 
> > Thanks,  
> > Yossi

---

<div class="post-metadata">

**Author:** ![Rob](https://avatars.discourse-cdn.com/v4/letter/r/838e76/32.png) [@Rob](https://discourse.sensu.io/u/Rob)\
**Post date:** [August 16, 2015, 4:21pm UTC](https://discourse.sensu.io/t/events-history/477/3 "2015-08-16T16:21:13Z")

</div>

We use a modified logstash handler ([https://github.com/sensu-plugins/sensu-plugins-logstash/blob/master/bin/handler-logstash.rb](https://github.com/sensu-plugins/sensu-plugins-logstash/blob/master/bin/handler-logstash.rb)) to write events to our ELK stack, that way we can see event history.

At one point I experimented with writing a small Sinatra app to allow us to embed the logs from elasticsearch in Uchiwa, here’s a screenshot: [http://a.disquscdn.com/uploads/mediaembed/images/1439/1041/original.jpg?w=800&h](http://a.disquscdn.com/uploads/mediaembed/images/1439/1041/original.jpg?w=800&h)

> **···**
>
> On 16 August 2015 at 17:13, Kyle Anderson [kyle@xkyle.com](mailto:kyle@xkyle.com) wrote:
> 
> > Sensu doesn’t have an internal capability to store long term data like
> > 
> > that, it is more like an event processor.
> > 
> > I’m not aware of an existing sensu extension to store all of the
> > 
> > historical event data somewhere. (like a sensudb?) But I sure wish
> > 
> > someone would make one! 🙂
> > 
> > The only other thing you could use out-of-the-box is the sensu logs.
> > 
> > On Sat, Aug 15, 2015 at 11:46 PM, Yossi Nachum [nachum234@gmail.com](mailto:nachum234@gmail.com) wrote:
> > 
> > > Hi Guys,
> > 
> > > 
> > 
> > > I installed two weeks sensu with uchiwa for my first time.
> > 
> > > 
> > 
> > > I am trying to look for old events (what happen last week) and I don’t see
> > 
> > > any option to get it.
> > 
> > > 
> > 
> > > how do you see old events in sensu?
> > 
> > > 
> > 
> > > I found only this api [http://localhost:4567/clients/client\_name/history](http://localhost:4567/clients/client_name/history) and
> > 
> > > I see there only the last execution time and I am looking for events that
> > 
> > > triggered warning or critical thresholds
> > 
> > > 
> > 
> > > Thanks,
> > 
> > > Yossi
> > 
> > > 
> > 
> > >

---

<div class="post-metadata">

**Author:** ![Yossi\_Nachum](https://avatars.discourse-cdn.com/v4/letter/y/b9bd4f/32.png) [@Yossi\_Nachum](https://discourse.sensu.io/u/Yossi_Nachum)\
**Post date:** [August 17, 2015, 6:52am UTC](https://discourse.sensu.io/t/events-history/477/4 "2015-08-17T06:52:13Z")

</div>

Thanks it looks like good solutions for what I was looking for

Do you have any suggestions for maps like Nagvis (maps for nagios)?

> **···**
>
> On Sun, Aug 16, 2015 at 7:21 PM, Rob [roobert@gmail.com](mailto:roobert@gmail.com) wrote:
> 
> > We use a modified logstash handler ([https://github.com/sensu-plugins/sensu-plugins-logstash/blob/master/bin/handler-logstash.rb](https://github.com/sensu-plugins/sensu-plugins-logstash/blob/master/bin/handler-logstash.rb)) to write events to our ELK stack, that way we can see event history.
> 
> > At one point I experimented with writing a small Sinatra app to allow us to embed the logs from elasticsearch in Uchiwa, here’s a screenshot: [http://a.disquscdn.com/uploads/mediaembed/images/1439/1041/original.jpg?w=800&h](http://a.disquscdn.com/uploads/mediaembed/images/1439/1041/original.jpg?w=800&h)
> 
> On 16 August 2015 at 17:13, Kyle Anderson [kyle@xkyle.com](mailto:kyle@xkyle.com) wrote:
> 
> > Sensu doesn’t have an internal capability to store long term data like
> > 
> > that, it is more like an event processor.
> > 
> > I’m not aware of an existing sensu extension to store all of the
> > 
> > historical event data somewhere. (like a sensudb?) But I sure wish
> > 
> > someone would make one! 🙂
> > 
> > The only other thing you could use out-of-the-box is the sensu logs.
> > 
> > On Sat, Aug 15, 2015 at 11:46 PM, Yossi Nachum [nachum234@gmail.com](mailto:nachum234@gmail.com) wrote:
> > 
> > > Hi Guys,
> > 
> > > 
> > 
> > > I installed two weeks sensu with uchiwa for my first time.
> > 
> > > 
> > 
> > > I am trying to look for old events (what happen last week) and I don’t see
> > 
> > > any option to get it.
> > 
> > > 
> > 
> > > how do you see old events in sensu?
> > 
> > > 
> > 
> > > I found only this api [http://localhost:4567/clients/client\_name/history](http://localhost:4567/clients/client_name/history) and
> > 
> > > I see there only the last execution time and I am looking for events that
> > 
> > > triggered warning or critical thresholds
> > 
> > > 
> > 
> > > Thanks,
> > 
> > > Yossi
> > 
> > > 
> > 
> > >

---

<div class="post-metadata">

**Author:** ![GautumAni](https://avatars.discourse-cdn.com/v4/letter/g/eada6e/32.png) [@GautumAni](https://discourse.sensu.io/u/GautumAni)\
**Post date:** [March 1, 2017, 10:45am UTC](https://discourse.sensu.io/t/events-history/477/5 "2017-03-01T10:45:45Z")

</div>

Does anyone has new solution for this problem now ? I am using influxdb+grafana for metrics and i would like to store events as well. Without event history it would be very difficult to triage anythings.

> **···**
>
> On Monday, August 17, 2015 at 12:22:14 PM UTC+5:30, Yossi Nachum wrote:
> 
> > Thanks it looks like good solutions for what I was looking for
> 
> > Do you have any suggestions for maps like Nagvis (maps for nagios)?
> 
> > On Sun, Aug 16, 2015 at 7:21 PM, Rob [roo...@gmail.com](mailto:roo...@gmail.com) wrote:
> > 
> > > We use a modified logstash handler ([https://github.com/sensu-plugins/sensu-plugins-logstash/blob/master/bin/handler-logstash.rb](https://github.com/sensu-plugins/sensu-plugins-logstash/blob/master/bin/handler-logstash.rb)) to write events to our ELK stack, that way we can see event history.
> 
> > > At one point I experimented with writing a small Sinatra app to allow us to embed the logs from elasticsearch in Uchiwa, here’s a screenshot: [http://a.disquscdn.com/uploads/mediaembed/images/1439/1041/original.jpg?w=800&h](http://a.disquscdn.com/uploads/mediaembed/images/1439/1041/original.jpg?w=800&h)
> 
> > > On 16 August 2015 at 17:13, Kyle Anderson [ky...@xkyle.com](mailto:ky...@xkyle.com) wrote:
> > > 
> > > > Sensu doesn’t have an internal capability to store long term data like
> > > > 
> > > > that, it is more like an event processor.
> > > > 
> > > > I’m not aware of an existing sensu extension to store all of the
> > > > 
> > > > historical event data somewhere. (like a sensudb?) But I sure wish
> > > > 
> > > > someone would make one! 🙂
> > > > 
> > > > The only other thing you could use out-of-the-box is the sensu logs.
> > > > 
> > > > On Sat, Aug 15, 2015 at 11:46 PM, Yossi Nachum [nach...@gmail.com](mailto:nach...@gmail.com) wrote:
> > > > 
> > > > > Hi Guys,
> > > > 
> > > > > 
> > > > 
> > > > > I installed two weeks sensu with uchiwa for my first time.
> > > > 
> > > > > 
> > > > 
> > > > > I am trying to look for old events (what happen last week) and I don’t see
> > > > 
> > > > > any option to get it.
> > > > 
> > > > > 
> > > > 
> > > > > how do you see old events in sensu?
> > > > 
> > > > > 
> > > > 
> > > > > I found only this api [http://localhost:4567/clients/client\_name/history](http://localhost:4567/clients/client_name/history) and
> > > > 
> > > > > I see there only the last execution time and I am looking for events that
> > > > 
> > > > > triggered warning or critical thresholds
> > > > 
> > > > > 
> > > > 
> > > > > Thanks,
> > > > 
> > > > > Yossi
> > > > 
> > > > > 
> > > > 
> > > > >
> 
> > >
> 
> >

---

<div class="post-metadata">

**Author:** ![Alexander\_Skiba](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.sensu.io/alexander_skiba/32/408_2.png) [@Alexander\_Skiba](https://discourse.sensu.io/u/Alexander_Skiba)\
**Post date:** [March 2, 2017, 9:30am UTC](https://discourse.sensu.io/t/events-history/477/6 "2017-03-02T09:30:56Z")

</div>

You can have Sensu send events to an Elastic stack (Logstash, Elasticsearch, Kibana, etc) - that should be possible with the logstash handler as far as I remember.

However, that way you will only get entries for warnings and alerts but _not_ when things turn okay again. Do that you’d have to specify the type of the check as metric; metrics always trigger handlers, even exit code 0 of the check script.

I wouldn’t want to that though - without having tested it I would think this will lead to a huge performance loss at scale given the amount of extra handling required.

Keep in mind that this advice is theoretical and I do not have data to support my theory.

> **···**
>
> On Wednesday, March 1, 2017 at 11:45:45 AM UTC+1, GautumAni wrote:
> 
> > Does anyone has new solution for this problem now ? I am using influxdb+grafana for metrics and i would like to store events as well. Without event history it would be very difficult to triage anythings.

---

<div class="post-metadata">

**Author:** ![Shanker\_Balan](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.sensu.io/shanker_balan/32/84_2.png) [@Shanker\_Balan](https://discourse.sensu.io/u/Shanker_Balan)\
**Post date:** [March 3, 2017, 4:35am UTC](https://discourse.sensu.io/t/events-history/477/7 "2017-03-03T04:35:35Z")

</div>

Comments inline.

> **···**
>
> > On 02-Mar-2017, at 3:00 PM, Alexander Skiba [ghostlyrics@gmail.com](mailto:ghostlyrics@gmail.com) wrote:
> 
> > On Wednesday, March 1, 2017 at 11:45:45 AM UTC+1, GautumAni wrote:
> > 
> > > Does anyone has new solution for this problem now ? I am using influxdb+grafana for metrics and i would like to store events as well. Without event history it would be very difficult to triage anythings.
> 
> > 
> 
> > You can have Sensu send events to an Elastic stack (Logstash, Elasticsearch, Kibana, etc) - that should be possible with the logstash handler as far as I remember.
> 
> > However, that way you will only get entries for warnings and alerts but _not_ when things turn okay again. Do that you’d have to specify the type of the check as metric; metrics always trigger handlers, even exit code 0 of the check script.
> 
> > 
> 
> > I wouldn’t want to that though - without having tested it I would think this will lead to a huge performance loss at scale given the amount of extra handling required.
> 
> > Keep in mind that this advice is theoretical and I do not have data to support my theory.
> 
> I use ElasticSearch with Grafana+Kibana for visualisation. One issue is that I am yet to find a
> 
> ready made Sensu dashboards for Grafana or Kibana.
> 
> Havent had the time to work on a fully featured dashboard yet so for now, I am happy
> 
> with basic metrics+analytics that I have in place with Kibana/Grafana.
> 
> Regards.
> 
> @shankerbalan

---

<div class="post-metadata">

**Author:** ![GautumAni](https://avatars.discourse-cdn.com/v4/letter/g/eada6e/32.png) [@GautumAni](https://discourse.sensu.io/u/GautumAni)\
**Post date:** [March 6, 2017, 10:01am UTC](https://discourse.sensu.io/t/events-history/477/8 "2017-03-06T10:01:13Z")

</div>

Thx for your reply Alexander and Shankar

I am using influxdb + Grafana for metrics and i am avoiding to introduce once more stack by ELK or ELG. That will make my setup more complex.  
InfluxDB+Grafana is doing good for metrics but i want to have events history as well something like pnp4nagios does in nagios.

Regards  
Anirudh

> **···**
>
> On Friday, March 3, 2017 at 10:05:43 AM UTC+5:30, Shanker Balan wrote:
> 
> > Comments inline.
> > 
> > > On 02-Mar-2017, at 3:00 PM, Alexander Skiba [ghost...@gmail.com](mailto:ghost...@gmail.com) wrote:
> 
> > > On Wednesday, March 1, 2017 at 11:45:45 AM UTC+1, GautumAni wrote:
> > > 
> > > > Does anyone has new solution for this problem now ? I am using influxdb+grafana for metrics and i would like to store events as well. Without event history it would be very difficult to triage anythings.
> 
> > >
> 
> > > You can have Sensu send events to an Elastic stack (Logstash, Elasticsearch, Kibana, etc) - that should be possible with the logstash handler as far as I remember.
> 
> > > However, that way you will only get entries for warnings and alerts but _not_ when things turn okay again. Do that you’d have to specify the type of the check as metric; metrics always trigger handlers, even exit code 0 of the check script.
> 
> > >
> 
> > > I wouldn’t want to that though - without having tested it I would think this will lead to a huge performance loss at scale given the amount of extra handling required.
> 
> > > Keep in mind that this advice is theoretical and I do not have data to support my theory.
> 
> > 
> 
> > I use ElasticSearch with Grafana+Kibana for visualisation. One issue is that I am yet to find a
> 
> > ready made Sensu dashboards for Grafana or Kibana.
> 
> > 
> 
> > Havent had the time to work on a fully featured dashboard yet so for now, I am happy
> 
> > with basic metrics+analytics that I have in place with Kibana/Grafana.
> 
> > 
> 
> > Regards.
> 
> > @shankerbalan
> 
> > 
> 
> > 
> 
> >

---

<div class="post-metadata">

**Author:** ![Philipp\_H](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.sensu.io/philipp_h/32/539_2.png) [@Philipp\_H](https://discourse.sensu.io/u/Philipp_H)\
**Post date:** [March 9, 2017, 12:51pm UTC](https://discourse.sensu.io/t/events-history/477/9 "2017-03-09T12:51:05Z")

</div>

I collect all Sensu server and client logs using filebeat. They are parsed with logstash json filter and send to graylog. The beauty of this setup is that you get all OK and failure events without additional server load. This even works if the Sensu server is offline because the client still logs everything...

---

<div class="post-metadata">

**Author:** ![Shanker\_Balan](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.sensu.io/shanker_balan/32/84_2.png) [@Shanker\_Balan](https://discourse.sensu.io/u/Shanker_Balan)\
**Post date:** [March 9, 2017, 3:24pm UTC](https://discourse.sensu.io/t/events-history/477/10 "2017-03-09T15:24:16Z")

</div>

Hi Philipp,

> **···**
>
> On 09-Mar-2017, at 6:21 PM, Philipp H \<hellmi@gmail.com\> wrote:
> 
> > I collect all Sensu server and client logs using filebeat. They are parsed with logstash json filter and send to graylog. The beauty of this setup is that you get all OK and failure events without additional server load. This even works if the Sensu server is offline because the client still logs everything...
> 
> Thats indeed a neat idea. I’ll give it a shot myself.
> 
> Thanks.  
> @shankerbalan

---

<div class="post-metadata">

**Author:** ![Shanker\_Balan](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.sensu.io/shanker_balan/32/84_2.png) [@Shanker\_Balan](https://discourse.sensu.io/u/Shanker_Balan)\
**Post date:** [April 5, 2017, 4:58pm UTC](https://discourse.sensu.io/t/events-history/477/11 "2017-04-05T16:58:29Z")

</div>

Hi Philipp,

> Hi Philipp,
> 
> > I collect all Sensu server and client logs using filebeat. They are parsed with logstash json filter and send to graylog. The beauty of this setup is that you get all OK and failure events without additional server load. This even works if the Sensu server is offline because the client still logs everything...
> 
> Thats indeed a neat idea. I’ll give it a shot myself.

So I started implementing filebeat with ELK and I ran into an issue where the  
sensu-event timestamp is in microsecond precision while elastic-search only(?) seem to handle  
millisec resolution.

shanker@ib-mon1:~$ tail -1 /var/log/sensu/sensu-server.log|jq .timestamp  
"2017-04-05T22:07:33.868684+0530”

Replacing @timestamp with sensu event timestamp causes updates to fail as a result.

Curious to know how other have handled the situation.

Regards.  
@shankerbalan

> **···**
>
> > On 09-Mar-2017, at 8:54 PM, mail@shankerbalan.net wrote:  
> > On 09-Mar-2017, at 6:21 PM, Philipp H \<hellmi@gmail.com\> wrote:

---

<div class="post-metadata">

**Author:** ![Philipp\_H](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.sensu.io/philipp_h/32/539_2.png) [@Philipp\_H](https://discourse.sensu.io/u/Philipp_H)\
**Post date:** [April 9, 2017, 7:57am UTC](https://discourse.sensu.io/t/events-history/477/12 "2017-04-09T07:57:08Z")

</div>

I send logs from filebeat to logstash. Logstash has a date filter which can parse the timestamp. I can share my configuration if you have problems with logstash.

---

<div class="post-metadata">

**Author:** ![Shanker\_Balan](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.sensu.io/shanker_balan/32/84_2.png) [@Shanker\_Balan](https://discourse.sensu.io/u/Shanker_Balan)\
**Post date:** [April 10, 2017, 5:29am UTC](https://discourse.sensu.io/t/events-history/477/13 "2017-04-10T05:29:04Z")

</div>

Hi Philipp,

> I send logs from filebeat to logstash. Logstash has a date filter which can parse the timestamp. I can share my configuration if you have problems with logstash.

Thanks for responding.

I put the below logstash 5.3 configs in place over the weekend and it seems to be working well. It  
would be great if you can share your config as well.

filter {  
&nbsp;&nbsp;if [type] == "sensu" {  
&nbsp;&nbsp;&nbsp;&nbsp;ruby {  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;init =\> 'require "date"'  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;code =\> '  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;t = event.get("timestamp");  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;event.set("ts\_iso8601", DateTime.parse(t).iso8601(3) );  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'  
&nbsp;&nbsp;&nbsp;&nbsp;}  
&nbsp;&nbsp;&nbsp;&nbsp;date {  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;match =\> ["ts\_iso8601" , "ISO8601"]  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;target =\> "@timestamp"  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;add\_tag =\> ["ts\_iso8601\_applied"]  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;remove\_field =\> ["ts\_iso8601", "timestamp"]  
&nbsp;&nbsp;&nbsp;&nbsp;}  
&nbsp;&nbsp;&nbsp;&nbsp;mutate {  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;remove\_field =\> ["event.client.redact"]  
&nbsp;&nbsp;&nbsp;&nbsp;}  
&nbsp;&nbsp;}  
}

And this is how the event now looks like.

{  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"offset" =\> 8267507,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"level" =\> "info",  
&nbsp;&nbsp;&nbsp;&nbsp;"subscribers" =\> [  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[0] "admins",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[1] "os:Ubuntu"  
&nbsp;&nbsp;&nbsp;&nbsp;],  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"input\_type" =\> "log",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"source" =\> "/var/log/sensu/sensu-server.log",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"message" =\> "publishing check request",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"type" =\> "sensu",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"tags" =\> [  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[0] "beats",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[1] "beats\_input\_codec\_plain\_applied",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[2] "ts\_iso8601\_applied"  
&nbsp;&nbsp;&nbsp;&nbsp;],  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"@timestamp" =\> 2017-04-10T05:25:29.397Z,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"payload" =\> {  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"occurrences" =\> 5,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"high\_flap\_threshold" =\> 60,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"standalone" =\> false,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"refresh" =\> 3600,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"handle" =\> true,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"ttl" =\> 300,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"timeout" =\> 15,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"command" =\> "/usr/lib/nagios/plugins/check\_procs -w 3 -c 5 -s Z",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"aggregate" =\> false,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"handlers" =\> [  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[0] "mailer",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[1] "logstash"  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;],  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"name" =\> "zombie\_procs",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"issued" =\> 1491801929,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"low\_flap\_threshold" =\> 20  
&nbsp;&nbsp;&nbsp;&nbsp;},  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"@version" =\> "1",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"beat" =\> {  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"hostname" =\> "sensu-nmv-mon1",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"name" =\> "sensu-nmv-mon1",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"version" =\> "5.3.0"  
&nbsp;&nbsp;&nbsp;&nbsp;},  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"host" =\> "sensu-nmv-mon1"  
}

Thanks again.  
@shankerbalan

> **···**
>
> > On 09-Apr-2017, at 1:27 PM, Philipp H \<hellmi@gmail.com\> wrote:

---

<div class="post-metadata">

**Author:** ![Philipp\_H](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.sensu.io/philipp_h/32/539_2.png) [@Philipp\_H](https://discourse.sensu.io/u/Philipp_H)\
**Post date:** [April 10, 2017, 7:33am UTC](https://discourse.sensu.io/t/events-history/477/14 "2017-04-10T07:33:30Z")

</div>

Ok this is my logstash sensu filter:

> <https://gist.github.com/runningman84/d8e7c254b6c7ccf3094a556029ff346e>

> **···**
>
> Am Montag, 10. April 2017 07:29:15 UTC+2 schrieb Shanker Balan:
> 
> > Hi Philipp,
> > 
> > > On 09-Apr-2017, at 1:27 PM, Philipp H [hel...@gmail.com](mailto:hel...@gmail.com) wrote:
> > > 
> > > I send logs from filebeat to logstash. Logstash has a date filter which can parse the timestamp. I can share my configuration if you have problems with logstash.
> > 
> > Thanks for responding.
> > 
> > I put the below logstash 5.3 configs in place over the weekend and it seems to be working well. It  
> > would be great if you can share your config as well.
> > 
> > filter {  
> > if [type] == “sensu” {  
> > ruby {  
> > init =\> ‘require “date”’  
> > code =\> ’  
> > t = event.get(“timestamp”);  
> > event.set(“ts\_iso8601”, DateTime.parse(t).iso8601(3) );  
> > ’  
> > }  
> > date {  
> > match =\> [“ts\_iso8601” , “ISO8601”]  
> > target =\> “@timestamp”  
> > add\_tag =\> [“ts\_iso8601\_applied”]  
> > remove\_field =\> [“ts\_iso8601”, “timestamp”]  
> > }  
> > mutate {  
> > remove\_field =\> [“event.client.redact”]  
> > }  
> > }  
> > }
> > 
> > And this is how the event now looks like.
> > 
> > {  
> > “offset” =\> 8267507,  
> > “level” =\> “info”,  
> > “subscribers” =\> [  
> > [0] “admins”,  
> > [1] “os:Ubuntu”  
> > ],  
> > “input\_type” =\> “log”,  
> > “source” =\> “/var/log/sensu/sensu-server.log”,  
> > “message” =\> “publishing check request”,  
> > “type” =\> “sensu”,  
> > “tags” =\> [  
> > [0] “beats”,  
> > [1] “beats\_input\_codec\_plain\_applied”,  
> > [2] “ts\_iso8601\_applied”  
> > ],  
> > “@timestamp” =\> 2017-04-10T05:25:29.397Z,  
> > “payload” =\> {  
> > “occurrences” =\> 5,  
> > “high\_flap\_threshold” =\> 60,  
> > “standalone” =\> false,  
> > “refresh” =\> 3600,  
> > “handle” =\> true,  
> > “ttl” =\> 300,  
> > “timeout” =\> 15,  
> > “command” =\> “/usr/lib/nagios/plugins/check\_procs -w 3 -c 5 -s Z”,  
> > “aggregate” =\> false,  
> > “handlers” =\> [  
> > [0] “mailer”,  
> > [1] “logstash”  
> > ],  
> > “name” =\> “zombie\_procs”,  
> > “issued” =\> 1491801929,  
> > “low\_flap\_threshold” =\> 20  
> > },  
> > “@version” =\> “1”,  
> > “beat” =\> {  
> > “hostname” =\> “sensu-nmv-mon1”,  
> > “name” =\> “sensu-nmv-mon1”,  
> > “version” =\> “5.3.0”  
> > },  
> > “host” =\> “sensu-nmv-mon1”  
> > }
> > 
> > Thanks again.  
> > @shankerbalan

---

<div class="post-metadata">

**Author:** ![Shanker\_Balan](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.sensu.io/shanker_balan/32/84_2.png) [@Shanker\_Balan](https://discourse.sensu.io/u/Shanker_Balan)\
**Post date:** [April 11, 2017, 4:46am UTC](https://discourse.sensu.io/t/events-history/477/15 "2017-04-11T04:46:41Z")

</div>

Hi Philipp,

> **···**
>
> > On 10-Apr-2017, at 1:03 PM, Philipp H \<hellmi@gmail.com\> wrote:
> > 
> > Ok this is my logstash sensu filter:
> > 
> > [sensu logstash filter · GitHub](https://gist.github.com/runningman84/d8e7c254b6c7ccf3094a556029ff346e)
> 
> Your filter is awesome and I am learning a lot from it. Thank you very much  
> for sharing it publicly.
> 
> Regards.  
> @shankerbalan

---

<div class="post-metadata">

**Author:** ![jspaleta](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.sensu.io/jspaleta/32/141_2.png) [@jspaleta](https://discourse.sensu.io/u/jspaleta)\
**Post date:** [November 22, 2018, 2:07am UTC](https://discourse.sensu.io/t/events-history/477/16 "2018-11-22T02:07:39Z")

</div>