We want to discard the message if the severity is unknown.
case severity
when /ok/
ok msg
when /warning/
warning msg
when /critical/
critical msg
when /unknown/
unknown msg
end
How do I not send any message at all from a sensu check in the run proc?
Can I get a bit more context on what you are trying to accomplish? Is this in the context of writing a handler? What is the reason you do not want to send anything in the case of an unknown? You probably want to send something so that the server logs the error. If you are wanting to prevent a particular handler from being executed when the check/metric result was an unknown you can accomplish this on a per handler basis via config as described below.
In your handler configuration you can specify an array of severities for your handler to action on. You can use warning, critical, and unknown. ok events are always sent to it and the handler decides what to do with it as on an ok in the case of pagerduty would automatically resolve the incident. By removing unknown from your handler config you can avoid being alerted for an unknown severity. Alternatively you could write a filter that prevents the handler from being called as well.
we have a bit of a unique situation here. A very big company in which I have no access to the sensu server. Now if I am understanding sensu the server is the place to filter messages. Not the client. Is this correct?
We are being asked to throttle and exclude messages on the client. That works fine for messages that flow from nxlog to sensu but for checks from sensu we do not have that option. The unknown status is one that they want to exclude from the output and handle the problem in another manner.
Filters and handlers are always run on the server side, if you have no access to the server the only thing you can do is remove the check from the client.