netdata json backend

netdata-template.json

{
  "netdata" : {
    "order" : 0,
    "template" : "netdata-*",
    "settings" : {
      "index" : {
        "number_of_shards" : "1",
        "number_of_replicas" : "0"
      }
    },
    "mappings" : {
      "netdata" : {
        "_source" : {
          "enabled" : true
        },
        "dynamic_templates": [
          {
            "string_fields": {
              "mapping": {
                "type": "keyword",
                "doc_values": true
              },
              "match_mapping_type": "string",
              "match": "*"
            }
          }
        ],
        "properties" : {
          "timestamp" : {
            "format" : "epoch_second",
            "type" : "date"
          },
          "value" : {
            "index" : true,
            "type" : "double",
            "doc_values" : true
          }
        }
      }
    },
    "aliases" : { }
  }
}

netdata.conf

[backend]
        enabled = yes
        type = json
        destination = syslog-ng-host:1234
        data source = average
        prefix = netdata
        hostname = ccfawe
        update every = 10
        buffer on failures = 10
        timeout ms = 20000
        send charts matching = *

syslog-ng.conf

source s_netdata {
  network(
    transport(tcp)
    port(1234)
    flags(no-parse)
    tags(netdata)
  );
};

parser p_netdata {
  json-parser(
    prefix("netdata.")
  );
};

filter f_netdata {
  match("users", value("netdata.chart_type"));
};

destination d_elastic_netdata {
  elasticsearch2 (
    cluster("syslog-ng")
    client_mode("http")
    index("netdata-${YEAR}.${MONTH}.${DAY}")
    time-zone(UTC)
    type("netdata")
    flush-limit(512)
    server("ccosvm0790")
    template("$(format-json --key netdata.* --rekey netdata.* --shift 8)\n")
    persist-name(elasticsearch-netdata)
  )
};

log {
  source(s_netdata);
  parser(p_netdata);
  filter(f_netdata);
  destination(d_elastic_netdata);
};