In Logstash, I'm trying to set a condition where if within a file named "cowrie.json", if a new message is received that starts with "login attempt*" - send an email.
This is what I tried:
output {
if [log][file][path] =~ "cowrie.json" {
if %{message} =~ "login attempt.*"{
email {
to => 'test@address.com'
subject => 'Honeypot Alert'
body => "Someone interacted with the honeypot!"
domain => 'mail.xconnect.net'
port => 25
}
}
}
}
If I remove the second if
statement, it works. Does anyone happen to know what I have to replace the second if
statement so that it would only apply to entires/messages that start with "login attempt"?
Huge thanks ahead!
Edit: SOLVED:
if "login attempt" in [message] {
or
if [message] =~ "^login attempt" {
The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.