Module Elasticsearch


This Module for Icinga Web 2 integrates your Elastic stack into Icinga Web 2. Based on [Elasticsearch] instances and event types you configure, the module allows you to display data collected by Beats , Logstash and any other source. After you’ve installed and configured the module, you can browse events via the host action.


The Module can be found here

How to install the module can be found here

Additional Info

Documentation on how to configure the module can be found here

To Do’s

We would appreciate if the community would share their experience with this module in :open_book: written or visual :video_camera: form as an screencast.

Best Practice

As reported from User TomaszSz for Windows Machines with german Desktop/LogSettings

for application logs (level error & warning - german systems)


for system logs

I’m trying to get this module running atm for some tests on single pc.
So, i was able to install elasticseach on icinga, winlogbeat on a windows machine.
Invoking some test rest queries on elasticsearch shows me some data (winglobeat by default is configured to gather at least application, system and security logs) - there are events.

Module seems to be working - it does not show any connection issues, log seems to be fine now (previously i had some issues with connectivity).

The problem, i have troubles configuring event type i think.
Event Type Name is unimportant - it’s just a name to show?
Instance is choosen.
Index=winlogbeat-* (should be fine, as i checked via api all entries begins with winlogbeat-datetime)
Filter= as i understand filters role is mainly to read logs from specific host instead of all of them?
But, using asterix (Filter=*) should get me everything?
What should i use here in the future if i use always FQDNs in icigna (co icinga host is always = Computer in eventlog)
Fields - at least eventid should get me something?
Fields=eventid ?

I’m trying then to get something via Icinga web interface, but it shows me “no events found”. :frowning:
This is my current test configuration:

Just a tip for debugging: Add Kibana to your setup and you’ll see exactly how your events look like and if there are any fields missing or wrongly-named.


Thank you!
It helped to solve my problems.
Looks like i have to use:
to compare FQDNs
and in my example event_id.

1 Like

Just if someone finds this usefull, i ended up with the following filters:
for application logs (level error & warning - german systems)
for system logs

1 Like

I’m trying to use this module but always getting 0 hits.
Connection to elasticsearch instance is working because if I change one connection parameter I get an error message.
eventtypes are configured like this:
Name syslog
Instance elasticsearch
Index syslog_*
Filter host=*
Fields host, message

Fields are available in elasticsearch (I checked through kibana).
Now if I fire a request like this via command line:
icingacli elasticsearch check --instance elasticsearch --crit 10 --warn 5 --index syslog_* --filter=host=* --from -1d
I get 0 hits when in reality I have more than a thousand hits from kibana.

Any suggestion?

Thank you in advance

Hello there and welcome to the community,
you might want to open a new topic with your issue :slight_smile:
This thread has been burried sinde Feb 2019, so a fresh issue could use a fresh topic, for visibility :wink:

1 Like