Skip to main content
Version: ⭐ 24.04

Elastic Events

The Elastic Events stream connector allows you to send data from Centreon to Elasticsearch. It sends data using the Elasticsearch APIs.

Use the Elastic Events stream connector if you want to retrieve all the data for the events. If you want to retrieve only metrics, use the Elastic Metrics stream connector.

An appropriate index template is created automatically by the stream connector so that your data is indexed properly in Elasticsearch. (The index template is the description of the format of the data that will be sent.)


Perform the installation as root on the server that will send data to Elasticsearch (central server, remote server, poller).

dnf install centreon-stream-connector-elasticsearch

Configuring your Elasticsearch server

You may need to configure your Elasticsearch server so that it can receive data from Centreon. Please refer to Elasticsearch's documentation. Make sure Elasticsearch is able to receive data sent by Centreon: flows must not be blocked by Elasticsearch's configuration or by a security equipment.

On your Elasticsearch server, you will need:

  • An index to store events sent by Centreon. You can create a centreon_status index with the following command:

    curl --user elastic:centreon-es-passwd -X PUT "<elastic_proto>://<elastic_ip>:<elastic_port>/centreon_status" -H 'Content-Type: application/json' \
    -d '{"mappings":{"properties":{"host":{"type":"keyword"},"service":{"type":"keyword"}, "output":{"type":"text"},"status":{"type":"keyword"},"state":{"type":"keyword"}, "type":{"type":"keyword"},"timestamp":{"type":"date","format":"epoch_second"}}}}'

    If you use a custom event format, you will have to modify the index creation accordingly.

  • A user / password with required privileges to POST data to the index.

Configuring the stream connector in Centreon

  1. On your central server, go to Configuration > Pollers > Broker configuration.
  2. Click on central-broker-master (or the appropriate broker configuration if it is a poller or a remote server that will send events).
  3. On the Output tab, select Generic - Stream connector from the list and then click Add. A new output appears in the list.
  4. Fill in the fields as follows:
NameElastic events
Filter categoryNeb
  1. To enable Centreon to connect to your Elasticsearch server, fill in the following mandatory parameters. The fields for the first entry are already present. Click on the +Add a new entry link located below the Filter category table to add another one.
TypeNameValue explanationValue exemple
stringelastic_urlThe url of the Elastic stackhttps://elastic-fqdn:9200/
stringelastic_index_statusElastic target index namecentreon_status
stringelastic_usernameElastic usernamea_username
stringelastic_passwordElastic passworda password
  1. Fill in any optional parameters you want (using the +Add a new entry link).
TypeNameValue explanationdefault value
stringlogfilethe file in which logs are written/var/log/centreon-broker/elastic-events-apiv2.log
numberlog_levellogging level from 1 (errors) to 3 (debug)1
  1. Use the stream connector's optional parameters to filter or adapt the data you want Centreon to send to Elasticsearch.

  2. Deploy the configuration.

  3. Restart centengine on all pollers:

    systemctl restart centengine

    Elasticsearch should now receive data from Centreon. To test if it is working, see Curl commands: testing the stream connector.

Filtering or adapting the data you want to send to Elasticsearch

All stream connectors have a set of optional parameters, that allow you to filter the data you will send to your Elasticsearch server, to reformat the data, to define a proxy...

Each optional parameter has a default value, that is indicated in the corresponding documentation.

  • To override the default value of a parameter, click on the +Add a new entry link located below the Filter category table to add a custom parameter. For example, if you want to only send to Elasticsearch the events handled by a poller named "poller-1", enter:

    type = string
    name = accepted_pollers
    value = poller-1
  • For the Elasticsearch Events stream connector, the following values always override the default values, you do not need to define them in the interface.

TypeNameDefault value for the stream connector

Event bulking

This stream connector is compatible with event bulking. Meaning that it is able to send more that one event in each call to the Elastic REST API.

To use this feature you must add the following parameter in the configuration of your stream connector.

numbermax_buffer_sizemore than one

Event format

This stream connector will send events with the following format.

service_status event

"event_type": "host",
"status": "CRITICAL",
"state": "2",
"state_type": 1,
"host": "my_host",
"service": "a_service",
"output": "CRITICAL: Burnin and Lootin"

host_status event

"event_type": "host",
"status": "DOWN",
"state": "1",
"state_type": 1,
"host": "my_host",
"output": "CRITICAL: No woman no cry",
"timestamp": 1637229207

Custom event format

This stream connector allows you to change the format of the event to suit your needs. Only the event part of the json is customizable. It also allows you to handle event types that are not handled by default such as ba_status events.

In order to use this feature you need to configure a json event format file and add a new stream connector parameter.


The event format configuration file must be readable by the centreon-broker user

To learn more about custom event formats and templating files, read this documentation.

Curl commands: testing the stream connector

Sending events

If you want to test that events are sent to Elasticsearch correctly:

  1. Log in to the server that you configured to send events to Elasticsearch (your central server, a remote server or a poller).
  2. Run the following command:
curl -u elastic:centreon-es-passwd --header 'content-type: application/json'  -X POST "<elastic_url>/_bulk" --data-binary '{"index":{"_index":"<elastic_index_status>"}}
{"host":"jamaica","status":"OK","state_type":1,"state":0,"timestamp":<a_recent_timestamp>,"event_type":"service","service":"kingston","output":"OK: Everything is gonna be alright"}

Replace all the <xxxx> inside the above command with the appropriate value.

  1. Check that the data has been received by Elasticsearch.