# Write check response on agent to log file

**URL:** <https://discourse.sensu.io/t/write-check-response-on-agent-to-log-file/1861>\
**Category:** Sensu Go\
**Created:** [June 10, 2020, 9:52am UTC](https://discourse.sensu.io/t/write-check-response-on-agent-to-log-file/1861 "2020-06-10T09:52:20Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![raulgs](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.sensu.io/raulgs/32/323_2.png) [@raulgs](https://discourse.sensu.io/u/raulgs)\
**Post date:** [June 10, 2020, 9:52am UTC](https://discourse.sensu.io/t/write-check-response-on-agent-to-log-file/1861/1 "2020-06-10T09:52:20Z")

</div>

Is there a way to write the output of failed checks into a log file?  
I am kind of thinking of a parameter that could be set on the agents, to write the responses of failed checks into a specific log file.

This way I could collect them with filebeat and send them to elastic.

---

<div class="post-metadata">

**Author:** ![todd](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.sensu.io/todd/32/936_2.png) [@todd](https://discourse.sensu.io/u/todd)\
**Post date:** [June 10, 2020, 2:16pm UTC](https://discourse.sensu.io/t/write-check-response-on-agent-to-log-file/1861/2 "2020-06-10T14:16:31Z")

</div>

Why not use an [elasticsearch handler](https://bonsai.sensu.io/assets/jkerry/sensu-go-elasticsearch) with a filter on it that only sends the event data on check failures?

---

<div class="post-metadata">

**Author:** ![raulgs](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.sensu.io/raulgs/32/323_2.png) [@raulgs](https://discourse.sensu.io/u/raulgs)\
**Post date:** [June 10, 2020, 2:29pm UTC](https://discourse.sensu.io/t/write-check-response-on-agent-to-log-file/1861/3 "2020-06-10T14:29:23Z")

</div>

Thats a valid question.  
I found that assets after posting my question.  
Will definitely give a it a look 🙂  
Thanks

---

<div class="post-metadata">

**Author:** ![raulgs](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.sensu.io/raulgs/32/323_2.png) [@raulgs](https://discourse.sensu.io/u/raulgs)\
**Post date:** [June 17, 2020, 2:55pm UTC](https://discourse.sensu.io/t/write-check-response-on-agent-to-log-file/1861/4 "2020-06-17T14:55:15Z")

</div>

Have you ever used that handler? I am clearly struggling to make it work…

---

<div class="post-metadata">

**Author:** ![todd](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.sensu.io/todd/32/936_2.png) [@todd](https://discourse.sensu.io/u/todd)\
**Post date:** [June 17, 2020, 2:57pm UTC](https://discourse.sensu.io/t/write-check-response-on-agent-to-log-file/1861/5 "2020-06-17T14:57:32Z")

</div>

I’ve only used it in a lab/demo environment. This is the handler definition I used.

```
type: Handler
api_version: core/v2
metadata:
  name: elasticsearch
  namespace: default
spec:
  type: pipe
  command: sensu-go-elasticsearch --index sensu --full_event_logging
  env_vars:
  - ELASTICSEARCH_URL=http://backend:9200
  filters:
  runtime_assets:
  - jkerry/sensu-go-elasticsearch
```

---

<div class="post-metadata">

**Author:** ![raulgs](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.sensu.io/raulgs/32/323_2.png) [@raulgs](https://discourse.sensu.io/u/raulgs)\
**Post date:** [June 17, 2020, 9:42pm UTC](https://discourse.sensu.io/t/write-check-response-on-agent-to-log-file/1861/6 "2020-06-17T21:42:40Z")

</div>

Did this work without credentials? 🤔

---

<div class="post-metadata">

**Author:** ![todd](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.sensu.io/todd/32/936_2.png) [@todd](https://discourse.sensu.io/u/todd)\
**Post date:** [June 17, 2020, 9:59pm UTC](https://discourse.sensu.io/t/write-check-response-on-agent-to-log-file/1861/7 "2020-06-17T21:59:44Z")

</div>

Yes, it was without credentials. However the README for the asset shows this as an example for username/password combinations:

`ELASTICSEARCH_URL=https://USERNAME:PASSWORD@URL_TO_ELASTICSEARCH:9243`

---

<div class="post-metadata">

**Author:** ![raulgs](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.sensu.io/raulgs/32/323_2.png) [@raulgs](https://discourse.sensu.io/u/raulgs)\
**Post date:** [June 19, 2020, 12:06pm UTC](https://discourse.sensu.io/t/write-check-response-on-agent-to-log-file/1861/8 "2020-06-19T12:06:50Z")

</div>

Ahhh I see there is an issue with the certificate… as it is a self signed cert that is automatically managed by the elastic cloud on kubernetes operator…

Can a TLS-Skip verify be implemented to this handler?

```auto
"handler":"elastic","level":"info","msg":"event pipe handler executed","namespace":"default","output":"Error: error sending metric data to elasticsearch: Error getting response: x509: certificate signed by unknown authority\

```

---

<div class="post-metadata">

**Author:** ![todd](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.sensu.io/todd/32/936_2.png) [@todd](https://discourse.sensu.io/u/todd)\
**Post date:** [June 19, 2020, 3:11pm UTC](https://discourse.sensu.io/t/write-check-response-on-agent-to-log-file/1861/9 "2020-06-19T15:11:56Z")

</div>

Oh yeah, I can see that being an issue. I will work on getting something done on that in the next few days. Will want to add support for providing your own CA as well.

---

<div class="post-metadata">

**Author:** ![todd](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.sensu.io/todd/32/936_2.png) [@todd](https://discourse.sensu.io/u/todd)\
**Post date:** [June 20, 2020, 8:36pm UTC](https://discourse.sensu.io/t/write-check-response-on-agent-to-log-file/1861/10 "2020-06-20T20:36:40Z")

</div>

My fork of that handler with --insecure-skip-verify and --trusted-ca-file support is now on Bonsai.

[https://bonsai.sensu.io/assets/nixwiz/sensu-go-elasticsearch](https://bonsai.sensu.io/assets/nixwiz/sensu-go-elasticsearch)

---

<div class="post-metadata">

**Author:** ![raulgs](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.sensu.io/raulgs/32/323_2.png) [@raulgs](https://discourse.sensu.io/u/raulgs)\
**Post date:** [June 22, 2020, 3:18pm UTC](https://discourse.sensu.io/t/write-check-response-on-agent-to-log-file/1861/11 "2020-06-22T15:18:34Z")

</div>

Wow that was fast.  
Works like expected - thanks a lot 👍