elastic / elastic/integrations

[Logstash]: Add rule templates and slo templates to Logstash integration to improve enterprise-readiness

Open
#18,504 1 comment 0 reactions 0 assignees View on GitHub
needs:triage
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

### Integration Name

Logstash [logstash]

### Dataset Name

logstash.*

### Integration Version

2.10.x

### Agent Version

9.3.3

### OS Version and Architecture

N/A

### User Goal

Monitor Logstash effectively via meaningful pre-configured Rule Templates and SLO Templates.

Some (non-exaustive) Ideas:

- Persistent Queue Fullness
- Memory Queue Fullness (the data is not generated yet by Logstash)
- Worker Utilization higher than x% for y time
- System Load 5m / 15m higher than threshold
- Health Report red/yellow for certain amount of time
- Failure reload of pipeline
- Logstash stopped (from the logs)
- Logstash OOM (from the logs)
- Nuber of Threads higher than threshold
- Open File Descriptors higher than threashold
- GeoIP database expiration

### Existing Features

The current version of the integration does not provide any rule template and slo template.

### What did you see?

NA

### Anything else?

To implement this we need to:

1. Bump the version of the Logstash integration package-spec to an appropriate version >3.5.x
2. Identify appropriate alert scenarios
3. Identify appropriate SLO scenarios
4. Implement scenarios

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.