Collecting Zabbix Data Through ECS Log Ingestion

Prerequisites

• Prepare an ECS for log collection. For details, see Purchasing an ECS. If you already have an available ECS, skip this step.
• Zabbix has been downloaded and installed on the ECS. For details, see Download and install Zabbix.

Configuring a Path for Storing Monitoring Data

Zabbix saves monitoring data on the server where Zabbix is located. You can perform the following steps to set a monitoring data storage path:

1. Log in to the server where Zabbix is located.
2. Open the zabbix_server.conf file.

   vim /etc/zabbix/zabbix_server.conf

3. Set the data storage path in the file.

   ExportDir=/tmp/

4. Restart the Zabbix service for the configuration to take effect.

   systemctl restart zabbix-server

   After the configuration takes effect, Zabbix generates a file (with the extension .ndjson) in the /tmp directory to save monitoring data.

Ingesting ECS Logs to LTS

1. Choose Log Ingestion > Ingestion Center in the navigation pane. Then, click ECS (Elastic Cloud Server).
2. The page for selecting a log stream is displayed.
   1. Select a log group from the drop-down list of Log Group, for example, lts-group-ECS.
   2. Select a log stream from the drop-down list of Log Stream, for example, lts-topic-ECS.
   3. Click Next: (Optional) Select Host Group.

3. Select host groups and click Next: Configurations.
4. Set the collection path to /tem/**/*.ndjson and retain the default values for other parameters. For details, see Ingesting ECS Text Logs to LTS.
   Figure 1 Configuring the collection
   

5. Click Next: Index Settings. On the displayed page, retain the default parameter settings. After configuring the index, you can query and analyze logs. For more information, see Setting Indexes.
6. Click Submit. After the log ingestion is complete, click Back to Ingestion Configurations. An ingestion rule will be displayed on the Ingestion Management page.
7. After the log ingestion is configured, you can view the reported logs on the LTS console in real time.

   Click the log stream name in the Log Stream column of the target ingestion rule to access the stream details page.

8. Click the Real-Time Logs tab to view logs in real time.

   Logs are reported to LTS once every five seconds. You may wait for at most five seconds before the logs are displayed.