0

I need an alerting system where I could have my own metric and threshold to report for anomalies (basically alerting on the basis of logs and data in DB). I explored Bosun but not sure how to make it work. I have following issues:-

  1. There are pre-defined items which are all system level, but I couldn't find a way to add new items, i.e. custom items
  2. How will bosun ingest data other than scollector. As I understand could I use logstash as data source and totally miss OpenTDSP( Really don't like HBase dependency)?
Mangat Rai Modi
  • 5,397
  • 8
  • 45
  • 75

1 Answers1

1

By Items I think you mean metrics. Bosun learns about metrics, and their tag relationships when you do one of the following:

  1. Relay opentsdb data through Bosun (http://bosun.org/api#sending-data)
  2. Get copies of metrics sent to the api/index route http://bosun.org/api#apiindex

There are also metadata routes, which tell bosun about the metric, such as counter/gauge, unit, and description.

The logstash datasource will be deprecated in favor of an elastic datasource in the coming 0.5.0 release. But it is replaced by an elastic one is better (but requires ES 2+). To use those expressions see the raw documentation (bosun.org docs will updated next release): https://raw.githubusercontent.com/bosun-monitor/bosun/master/docs/expressions.md. To add it you would have something like the following in the config:

elasticHosts=http://ny-lselastic01.ds.stackexchange.com:9200,http://ny-lselastic02.ds.stackexchange.com:9200,http://ny-lselastic03.ds.stackexchange.com:9200

The functions to query various backends are only loaded into the expression library when the backend is configured.

Kyle Brandt
  • 26,938
  • 37
  • 124
  • 165
  • So if I understand correctly, I could simply pass data from Elastic search to Bosun apiindex to train it about the metrics? If yes, will that remove the dependency on Opentdsp? – Mangat Rai Modi Feb 26 '16 at 11:01
  • You could but it would need to be in the format of OpenTSDB datapoints. IIRC, there doesn't need to be a value. The graph UI only work with opentsdb though. However, you can graph any expression (including elastic) in the expression page. – Kyle Brandt Feb 26 '16 at 16:02
  • 1
    Another option is to not index the data to bosun, and you can still do alerts and expressions, but the items page would be blank. – Kyle Brandt Feb 26 '16 at 16:02