Help Center/ Log Tank Service/ Best Practices/ Log Ingestion/ Collecting Zabbix Data Through ECS Log Ingestion
Updated on 2025-09-26 GMT+08:00
View PDF
Share

Collecting Zabbix Data Through ECS Log Ingestion

Zabbix is a popular open-source monitoring solution used to monitor systems with various alarm rules. LTS can collect monitoring data from Zabbix to log streams. This section describes how to collect Zabbix data by ingesting ECS logs to LTS.

Prerequisites

  • You have prepared an ECS whose logs are to be collected. For details, see Purchasing an ECS. If you already have an available ECS, skip this step.
  • Zabbix has been downloaded and installed on the ECS. For details of downloading and installing it, see the Zabbix website.

Step 1: Configure a Path for Storing Monitoring Data

Zabbix saves monitoring data on the server where Zabbix is located. To set a specific storage path, follow these steps:

  1. Log in to the server where Zabbix is located.
  2. Open the zabbix_server.conf file. 
    vim /etc/zabbix/zabbix_server.conf
  3. Set the data storage path in the file. 
    ExportDir=/tmp/
  4. Restart the Zabbix service for the configuration to take effect. 
    systemctl restart zabbix-server

    After the configuration takes effect, Zabbix will generate files with the .ndjson extension in the /tmp directory to save monitoring data.

Step 2: Ingest ECS Logs to LTS

  1. Log in to the LTS console.
  2. Choose Log Ingestion > Ingestion Center in the navigation pane and click ECS (Elastic Cloud Server).
  3. The page for selecting a log stream is displayed.

    1. Select a log group from the drop-down list of Log Group, for example, lts-group-ECS.
    2. Select a log stream from the drop-down list of Log Stream, for example, lts-topic-ECS.
    3. Click Next: (Optional) Select Host Group.

  4. Select host groups and click Next: Configurations.
  5. Set the collection path to /tem/**/*.ndjson and retain the default values for other parameters. For details, see Ingesting ECS Text Logs to LTS.

    Figure 1 Configuring the collection

  6. Click Next: Index Settings. On the displayed page, retain the default parameter settings. After configuring the index, you can query and analyze logs. For more information, see Setting Indexes.
  7. Click Submit. After the ingestion configuration is complete, click Back to Ingestion Configurations. An ingestion configuration will be displayed on the Ingestion Management page.
  8. After the log ingestion is configured, you can view the reported logs on the LTS console in real time.

    Click the log stream name in the Log Stream column of the target ingestion rule to access the stream details page.

  9. Click the Real-Time Logs tab to view logs in real time.

    Logs are reported to LTS once every five seconds. You may wait for at most five seconds before the logs are displayed.

Parent topic: Log Ingestion