Icinga2 check number of events in ELK stack

check-logstash-events.sh

#!/bin/bash
#
# Check number of events in Elasticsearch stored by Logstash
#

INDEX_NAME=$( date '+logstash-%Y.%m.%d' -d '30 minutes ago' )

function get_last_items() {
        curl -s -k -XGET "http://localhost:9200/$INDEX_NAME/_count" \
            -H "Content-type: application/json" -d'
        {
            "query": {
              "range": {
                "@timestamp": {
                  "gte": "now-60m",
                  "lte": "now"
                }
              }
            }
        }' | jq .count
}



TOTAL_EVENTS=$( get_last_items )

if [[ $TOTAL_EVENTS -gt 1024  ]]; then
        RETV=0
        echo -en "OK - got $TOTAL_EVENTS in last 60 minutes"
elif [[ $TOTAL_EVENTS -eq 0 ]]; then
        RETV=2
        echo -en "CRITICAL - no events in last 60 minutes"
elif [[ $TOTAL_EVENTS -eq 0 ]]; then
        RETV=1
        echo -en "WARNING - got $TOTAL_EVENTS in last 60 minutes"
fi
echo  "|events_found=$TOTAL_EVENTS"
exit $RETV