[英]Logstash email alerts
我配置了logstash以發送電子郵件警報,以防日志消息中包含某些單詞組合。 我收到警報,但沒有收到警報中的消息字段值,而是收到單詞“ @message”。 我怎么解決這個問題?
這是我的logstash配置文件:
root@srv-syslog:~# cat /etc/logstash/conf.d/central.conf
input {
syslog {
type => "syslog"
port => 5144
}
tcp {
type => "cisco_asa"
port => 5145
}
tcp {
type => "cisco_ios"
port => 5146
}
}
output {
elasticsearch {
bind_host => "127.0.0.1"
port => "9200"
protocol => http
}
if "executed the" in [message] {
email {
from => "logstash_alert@company.local"
subject => "logstash alert"
to => "myemail@company.local"
via => "smtp"
body => "Here is the event line that occured: %{@message}"
}
}
}
在這種情況下,字段名稱是message
,而不是@message
。
觀看演示:
input {
generator {
count => 1
lines => ["Example line."]
}
}
filter {
mutate {
add_field => {
"m1" => "%{message}"
"m2" => "%{@message}"
}
}
}
output {
stdout {
codec => rubydebug{}
}
}
對於您的情況,您只需要修復以下一行:
body => "Here is the event line that occured: %{message}"
刪除@符號。 該字段是消息,而不是@message。
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.