[英]Logstash email alerts
我配置了logstash以发送电子邮件警报,以防日志消息中包含某些单词组合。 我收到警报,但没有收到警报中的消息字段值,而是收到单词“ @message”。 我怎么解决这个问题?
这是我的logstash配置文件:
root@srv-syslog:~# cat /etc/logstash/conf.d/central.conf
input {
syslog {
type => "syslog"
port => 5144
}
tcp {
type => "cisco_asa"
port => 5145
}
tcp {
type => "cisco_ios"
port => 5146
}
}
output {
elasticsearch {
bind_host => "127.0.0.1"
port => "9200"
protocol => http
}
if "executed the" in [message] {
email {
from => "logstash_alert@company.local"
subject => "logstash alert"
to => "myemail@company.local"
via => "smtp"
body => "Here is the event line that occured: %{@message}"
}
}
}
在这种情况下,字段名称是message
,而不是@message
。
观看演示:
input {
generator {
count => 1
lines => ["Example line."]
}
}
filter {
mutate {
add_field => {
"m1" => "%{message}"
"m2" => "%{@message}"
}
}
}
output {
stdout {
codec => rubydebug{}
}
}
对于您的情况,您只需要修复以下一行:
body => "Here is the event line that occured: %{message}"
删除@符号。 该字段是消息,而不是@message。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.