This plugin sends Logstash events to the Logicmonitor Logs

Getting started

Installing through rubygems

Run the following on your Logstash instance

logstash-plugin install logstash-output-lmlogs

Minimal configuration

output {
    lmlogs {
        portal_name => "your company name"
        portal_domain => "your LM company domain."
        access_id => "your lm access id"
        access_key => "your access key"
    }
}

You would need either access_id and access_id both or bearer_token for authentication with Logicmonitor. The portal_domain is the domain of your LM portal. If not set the default is set to logicmonitor.com. Eg if your LM portal URL is https://test.lmgov.us, portal_name should be set to test and portal_domain to lmgov.us The allowed values for portal_domain are ["logicmonitor.com", "lmgov.us", "qa-lmgov.us"]

Important options

Option	Description	Default
batch_size	Event batch size to send to LM Logs.	100
message_key	Key that will be used by the plugin as the system key	"message"
lm_property	Key that will be used by LM to match resource based on property	"system.hostname"
keep_timestamp	If false, LM Logs will use the ingestion timestamp as the event timestamp	true
timestamp_is_key	If true, LM Logs will use a specified key as the event timestamp	false
timestamp_key	If timestamp_is_key is set, LM Logs will use this key in the event as the timestamp	"logtimestamp"
include_metadata	If true, all metadata fields will be sent to LM Logs	false
include_metadata_keys	Array of json keys for which plugin looks for these keys and adds as event meatadata. A dot "." can be used to add nested subjson. If config include_metadata is set to true, all metadata will be sent regardless of this config.	[]

See the source code for the full list of options

The syntax for message_key and source_key values are available in the Logstash Event API Documentation

Known issues

• Installation of the plugin fails on Logstash 6.2.1.

Contributing

Bug reports and pull requests are welcome. This project is intended to be a safe, welcoming space for collaboration.

Development

We use docker to build the plugin. You can build it by running docker-compose run jruby gem build logstash-output-lmlogs.gemspec