elastic / elastic/integrations
[Logstash]: Add rule templates and slo templates to Logstash integration to improve enterprise-readiness
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
### Integration Name
Logstash [logstash]
### Dataset Name
logstash.*
### Integration Version
2.10.x
### Agent Version
9.3.3
### OS Version and Architecture
N/A
### User Goal
Monitor Logstash effectively via meaningful pre-configured Rule Templates and SLO Templates.
Some (non-exaustive) Ideas:
- Persistent Queue Fullness
- Memory Queue Fullness (the data is not generated yet by Logstash)
- Worker Utilization higher than x% for y time
- System Load 5m / 15m higher than threshold
- Health Report red/yellow for certain amount of time
- Failure reload of pipeline
- Logstash stopped (from the logs)
- Logstash OOM (from the logs)
- Nuber of Threads higher than threshold
- Open File Descriptors higher than threashold
- GeoIP database expiration
### Existing Features
The current version of the integration does not provide any rule template and slo template.
### What did you see?
NA
### Anything else?
To implement this we need to:
1. Bump the version of the Logstash integration package-spec to an appropriate version >3.5.x
2. Identify appropriate alert scenarios
3. Identify appropriate SLO scenarios
4. Implement scenarios
Contributor guide
Assessment
This issue has not been assessed yet.