Table of Contents
5 Real-time export protocol
This section presents details of the real-time export protocol in a newline-delimited JSON format for:
All files have a .ndjson extension. Each line of the export file is a JSON object.
Trigger events
The following information is exported for a problem event:
| Field | Type | Description | ||
|---|---|---|---|---|
| clock | number | Number of seconds since Epoch to the moment when problem was detected (integer part). | ||
| ns | number | Number of nanoseconds to be added to clock to get a precise problem detection time. |
||
| value | number | 1 (always). | ||
| eventid | number | Problem event ID. | ||
| name | string | Problem event name. | ||
| severity | number | Problem event severity (0 - Not classified, 1 - Information, 2 - Warning, 3 - Average, 4 - High, 5 - Disaster). This property is exported since Zabbix 5.2.7. |
||
| hosts | array | List of hosts involved in the trigger expression; there should be at least one element in array. | ||
| - | object | |||
| host | string | Host name. | ||
| name | string | Visible host name. | ||
| groups | array | list of host groups of all hosts involved in the trigger expression; there should be at least one element in array. | ||
| - | string | Host group name. | ||
| tags | array | List of problem tags (can be empty). | ||
| - | object | |||
| tag | string | Tag name. | ||
| value | string | Tag value (can be empty). | ||
The following information is exported for a recovery event:
| Field | Type | Description |
|---|---|---|
| clock | number | Number of seconds since Epoch to the moment when problem was resolved (integer part). |
| ns | number | Number of nanoseconds to be added to clock to get a precise problem resolution time. |
| value | number | 0 (always). |
| eventid | number | Recovery event ID. |
| p_eventid | number | Problem event ID. |
Examples
Problem:
{"clock":1519304285,"ns":123456789,"value":1,"name":"Either Zabbix agent is unreachable on Host B or pollers are too busy on Zabbix Server","severity":3,"eventid":42, "hosts":[{"host":"Host B", "name":"Host B visible"},{"host":"Zabbix Server","name":"Zabbix Server visible"}],"groups":["Group X","Group Y","Group Z","Zabbix servers"],"tags":[{"tag":"availability","value":""},{"tag":"data center","value":"Riga"}]}Recovery:
Problem (multiple problem event generation):
{"clock":1519304286,"ns":123456789,"value":1,"eventid":43,"name":"Either Zabbix agent is unreachable on Host B or pollers are too busy on Zabbix Server","severity":3,"hosts":[{"host":"Host B", "name":"Host B visible"},{"host":"Zabbix Server","name":"Zabbix Server visible"}],"groups":["Group X","Group Y","Group Z","Zabbix servers"],"tags":[{"tag":"availability","value":""},{"tag":"data center","value":"Riga"}]}
{"clock":1519304286,"ns":123456789,"value":1,"eventid":43,"name":"Either Zabbix agent is unreachable on Host B or pollers are too busy on Zabbix Server","severity":3,"hosts":[{"host":"Host B", "name":"Host B visible"},{"host":"Zabbix Server","name":"Zabbix Server visible"}],"groups":["Group X","Group Y","Group Z","Zabbix servers"],"tags":[{"tag":"availability","value":""},{"tag":"data center","value":"Riga"}]}Recovery:
{"clock":1519304346,"ns":987654321,"value":0,"eventid":44,"p_eventid":43}
{"clock":1519304346,"ns":987654321,"value":0,"eventid":44,"p_eventid":42}Item values
The following information is exported for a collected item value:
| Field | Type | Description | |
|---|---|---|---|
| host | object | Host name of the item host. | |
| host | string | Host name. | |
| name | string | Visible host name. | |
| groups | array | List of host groups of the item host; there should be at least one element in array. | |
| - | string | Host group name. | |
| applications | array | List of the item applications; empty if there are none. | |
| - | string | Application name. | |
| itemid | number | Item ID. | |
| name | string | Visible item name. | |
| clock | number | Number of seconds since Epoch to the moment when value was collected (integer part). | |
| ns | number | Number of nanoseconds to be added to clock to get a precise value collection time. |
|
| timestamp (Log only) |
number | 0 if not available. | |
| source (Log only) |
string | Empty string if not available. | |
| severity (Log only) |
number | 0 if not available. | |
| eventid (Log only) |
number | 0 if not available. | |
| value | number (for numeric items) or string (for text items) |
Collected item value. | |
| type | number | Collected value type: 0 - numeric float, 1 - character, 2 - log, 3 - numeric unsigned, 4 - text |
|
Examples
Numeric (unsigned) value:
{"host":{"host":"Host B","name":"Host B visible"},"groups":["Group X","Group Y","Group Z"],"applications":["Zabbix Agent","Availability"],"itemid":3,"name":"Agent availability","clock":1519304285,"ns":123456789,"value":1,"type":3}Numeric (float) value:
{"host":{"host":"Host B","name":"Host B visible"},"groups":["Group X","Group Y","Group Z"],"applications":["CPU","Performance"],"itemid":4,"name":"CPU Load","clock":1519304285,"ns":123456789,"value":0.1,"type":0}Character, text value:
{"host":{"host":"Host B","name":"Host B visible"},"groups":["Group X","Group Y","Group Z"],"applications":["Zabbix Agent","Installed software versions"],"itemid":2,"name":"Agent version","clock":1519304285,"ns":123456789,"value":"3.4.4","type":4}Log value:
{"host":{"host":"Host A","name":"Host A visible"},"groups":["Group X","Group Y","Group Z"],"applications":["Log files","Critical"],"itemid":1,"name":"Messages in log file","clock":1519304285,"ns":123456789,"timestamp":1519304285,"source":"","severity":0,"eventid":0,"value":"log file message","type":2}Trends
The following information is exported for a calculated trend value:
| Field | Type | Description | |
|---|---|---|---|
| host | object | Host name of the item host. | |
| host | string | Host name. | |
| name | string | Visible host name. | |
| groups | array | List of host groups of the item host; there should be at least one element in array. | |
| - | string | Host group name. | |
| applications | array | List of the item applications; empty if there are none. | |
| - | string | Application name. | |
| itemid | number | Item ID. | |
| name | string | Visible item name. | |
| clock | number | Number of seconds since Epoch to the moment when value was collected (integer part). | |
| count | number | Number of values collected for a given hour. | |
| min | number | Minimum item value for a given hour. | |
| avg | number | Average item value for a given hour. | |
| max | number | Maximum item value for a given hour. | |
| type | number | Value type: 0 - numeric float, 3 - numeric unsigned |
|
Examples
Numeric (unsigned) value:
{"host":{"host":"Host B","name":"Host B visible"},"groups":["Group X","Group Y","Group Z"],"applications":["Zabbix Agent","Availability"],"itemid":3,"name":"Agent availability","clock":1519311600,"count":60,"min":1,"avg":1,"max":1,"type":3}Numeric (float) value: