email - Logstash 电子邮件从多个日志文件动态发出警报

Question

我有 logstash 配置文件，我在其中为消息中存在的特定文本编写了邮件警报，然后自动发送一封包含该消息的电子邮件。请找到配置文件 (logstash.conf)。`

输入{

file {

  path => [ "\\IP Address\logs/LMS.log.*_bak" ]
  start_position => "beginning"     

 }

输出{

elasticsearch {
        bind_host => "127.0.0.1"
        port => "9200"
        protocol => http
}

  if "ERROR" in [message]  {
 email {
        from => "logstash.alert@nowhere.com"
        subject => "logstash alert"
        to => "test.lms@gmail.com"
        via => "smtp"
        body => "Here is the event line that occured: %{message}"
    }
 }
}

`在这里我没有收到来自该配置的任何电子邮件。所以任何人都请找到该配置为我提供解决方案谢谢...

Answer 1

是的，我终于得到了针对消息字段中的任何错误发送电子邮件警报的解决方案。

output {

    elasticsearch {
            bind_host => "127.0.0.1"
            port => "9200"
            protocol => http
       }

    if  "ERROR" in [message]  {
    email  {
        options => [ "smtpIporHost", "smtp.gmail.com",
         "port", "587",
         "userName", "test@gmail.com",
         "password", "your password",
         "authenticationType", "plain",
         "starttls","true"
           ]
            from => "<test@gmail.com>"
            subject => "logstash alert"
            to => "<test@gmail.com>"
            via => "smtp"
            body => "Here is the event line that occured: %{message}"
       }
    }

    stdout { codec => rubydebug }
 }