Zabbix preprocessing: regex, JSONPath, JavaScript and dependent items

You’ll add everything to the template SaatVedha Nginx web from Lesson 10, so web01 picks it up automatically. If you skipped Lesson 10, do the same work on web01 directly; only the trigger expressions would name web01 instead of the template. Commands run on web01 or zbx01 as stated.

1Turn on stub_status on web01

Nginx’s stub_status module is built into the Ubuntu package. Add a small location to the default site that only answers local requests.

Run this on web01:

sudo tee /etc/nginx/conf.d/stub_status.conf >/dev/null <<'EOF'
server {
    listen 127.0.0.1:80;
    server_name localhost;
    location = /basic_status {
        stub_status;
        allow 127.0.0.1;
        deny all;
    }
}
EOF
sudo nginx -t && sudo systemctl reload nginx
curl -s http://127.0.0.1/basic_status

You should see this (your counter values will differ):

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
Active connections: 1
server accepts handled requests
 36 36 34
Reading: 0 Writing: 1 Waiting: 0 

The four lines are what Zabbix will parse. “accepts handled requests” are three counters since Nginx started; Reading, Writing and Waiting are current connection states.

✅ Checkpoint: curl on web01 prints the four stub_status lines.

2Check the master key with zabbix_get

Run this on zbx01 (with the PSK copy from Lesson 7 in /tmp/web01.psk):

zabbix_get -s 192.168.56.81 -k 'web.page.get[localhost,basic_status,80]' --tls-connect psk --tls-psk-identity 'PSK web01' --tls-psk-file /tmp/web01.psk

You should see this (your date and counters will differ):

HTTP/1.1 200 OK
Connection: close
Content-Length: 100
Content-Type: text/plain
Date: Sun, 08 Nov 2026 06:21:31 GMT
Server: nginx/1.28.3 (Ubuntu)

Active connections: 1
server accepts handled requests
 38 38 36
Reading: 0 Writing: 1 Waiting: 0 

That’s the raw value the master item will get: headers, a blank line, then the body. Your regexes must work on this whole text, not only on the four body lines.

The PSK options are needed because web01 accepts only encrypted connections since Lesson 6. If zabbix_get can’t connect, passive checks are blocked; the master item below is active, so you can carry on.

✅ Checkpoint: zabbix_get returns HTTP headers plus the stub_status body.

3Create the master item

Open the template (Data collection > Templates > SaatVedha Nginx web > Items > Create item):

Press Add. Because history is off, this item will show no value in Latest data; that’s expected, it only feeds the dependents.

✅ Checkpoint: The template has the item “Nginx: stub_status page” with History set to Do not store.

4Add regex dependent items

Click the master item’s name in the item list and choose Create dependent item from the menu, or create items with Type Dependent item and Master item “Nginx: stub_status page”. Make these four:

Open Nginx: requests total, go to its Preprocessing tab and press Test. Paste the whole zabbix_get output from step 2 (headers included) into the Value box and press Test.

The Test window lists step 1, Regular expression, with the result 36 next to it, and the final Result is 36: the third number on the counters line of the text you pasted.

The rate item would show no result in the same test, because Change per second needs a previous value; the test window has Previous value and Prev. time fields if you want to try it by hand. In real collection the second value a minute later gives the first rate.

✅ Checkpoint: Four dependent items exist, and Test shows a number after the regex step.

5Turn the whole page into JSON with JavaScript

A regex per field is fine for four numbers, but the dropped-connections figure needs maths (accepts minus handled). A single JavaScript step can produce all fields as JSON, and later items read them with JSONPath. First test the script on zbx01 with zabbix_js, which comes with the zabbix-server package:

Run this on zbx01:

cat > /tmp/stub.txt <<'EOF'
Active connections: 1
server accepts handled requests
 38 38 36
Reading: 0 Writing: 1 Waiting: 0
EOF
cat > /tmp/stub2json.js <<'EOF'
var m = value.match(/Active connections: (\d+)\s+server accepts handled requests\s+(\d+) (\d+) (\d+)\s+Reading: (\d+) Writing: (\d+) Waiting: (\d+)/);
if (!m) {
    throw 'stub_status format not recognised';
}
return JSON.stringify({
    active: Number(m[1]), accepts: Number(m[2]), handled: Number(m[3]),
    requests: Number(m[4]), reading: Number(m[5]), writing: Number(m[6]),
    waiting: Number(m[7]), dropped: Number(m[2]) - Number(m[3])
});
EOF
zabbix_js -s /tmp/stub2json.js -i /tmp/stub.txt

You should see:

{"active":1,"accepts":38,"handled":38,"requests":36,"reading":0,"writing":1,"waiting":0,"dropped":0}

That’s real output from the Zabbix JavaScript engine. Now create a dependent item Nginx: status JSON, key nginx.status.json, Type of information Text (or JSON in 8.0), History 1d, with one preprocessing step JavaScript and the script body pasted in (everything inside the file, without the cat lines).

✅ Checkpoint: zabbix_js prints one JSON line, and the item Nginx: status JSON exists with a JavaScript step.

6Chain JSONPath items off the JSON item

A dependent item can itself be a master. Create two dependent items whose master is Nginx: status JSON:

Test the first one: paste the JSON line that zabbix_js printed into the Value box and press Test. The input of a dependent item’s test is its own master’s value, here the JSON from Nginx: status JSON.

Step 1, JSONPath $.dropped, shows the result 0, and the final Result is 0.

Add a trigger in the template so dropped connections get noticed: min(/SaatVedha Nginx web/nginx.conn.dropped,5m)>0, name Nginx is dropping connections on {HOST.NAME}, severity Average.

✅ Checkpoint: Nginx: connections dropped and Nginx: connections writing test cleanly with JSONPath.

7Save storage with Discard unchanged with heartbeat

Waiting connections on a quiet lab server stay at 0 for hours, and storing 0 every minute is wasted rows. Open Nginx: connections waiting and add a second step Discard unchanged with heartbeat with parameter 15m.

Now Zabbix stores a value only when it changes, plus one every 15 minutes so nodata() triggers still know the item is alive. Don’t add this to items behind a last() or avg(...,5m) trigger that needs a point every minute.

✅ Checkpoint: Nginx: connections waiting has two steps: Regular expression, then Discard unchanged with heartbeat 15m.

8Load the site and read Latest data

Send some traffic from zbx01 so the counters move:

Run this on zbx01:

for i in $(seq 1 300); do curl -s -o /dev/null http://192.168.56.81/; done; echo done

In Monitoring > Latest data, host web01, tag component = nginx, each dependent item now has a value. Nginx: requests total has gone up by about 300, Nginx: requests per second shows a few requests per second for the minute the loop ran, Nginx: connections dropped stays at 0, and the master item has no value because it stores no history.

Seven items from one request a minute. The rate depends on how fast your loop ran and on where the minute boundaries fell.

✅ Checkpoint: Latest data shows values for the dependent items and the rate went up during the curl loop.