Dynamic attachments to email output

Elastic Stack Logstash
#1

Hey folks,

I'm trying to use the email output to send an alert including a file attachment using something like the following:

email {                                                                           |                                                                                         
    ...
    body        => "%{message}"                                                     |                                                                                         
    attachments => ["%{email_attachment}"]                                          |                                                                                         
}                                                                                 |

where "email_attachment" is a field with the path to a file on the logstash machine (something like "/tmp/file.tmp"). However when I actually try this out I get the following error:

Errno::ENOENT: No such file or directory - /Users/cjdimaggio/Downloads/sys/logstash-2.1.1/%{email_attachment}

which shows that the variable hasn't been interpolated into the string. I've tried changing the format a dozen different ways but to no avail. But I don't think that's even the problem; I've tested it out with mutate's add_tag, which similarly accepts an array, using:

mutate {                                                                              |        ';                                                                               
    add_tag => ["%{email_attachment}"]                                                  |}                                                                                        
}

and sure enough that adds the appropriate tag:

"tags" => [
    [0] "/tmp/file.tmp"
]

Is there something fundamental I'm missing? Are there just some config options that can't be dynamically filled? I see that in the documentation there are some fields that explicitly say "You can also use dynamic fields from the event with the %{fieldname} syntax." but then there are others that don't make that specification and still work. I also don't see anything in the email output's source code that would lead to that distinction. Any advice?

#2

Hello,

Indeed currently the attachments fields can only send the same attachments for all events.
I understand this is not the expected behavior so I registered an item in the issue tracker https://github.com/logstash-plugins/logstash-output-email/issues/34

If you need to fix it right away, I cannot think of a configuration workaround, but if acceptable you could try to modify slightly the file under vendor/bundle/jruby/1.9/gems/logstash-output-email-3.0.2/lib/logstash/outputs/email.rb of your logstash install as mentioned in the reported issue

Regarding the understanding of which field can be interpolated, there is indeed space for improvment in the doc.
If you browse the source code, you can easily spot event.sprintf() that is the interpolation method.
But this method can only be used when there is an event, so in the filter or receive methods but never in the register method

#3

Ah "sprint"! I knew that at one point when developing a custom plugin and it just wormed it's way completely out of my memory. Thank you so much for your thorough response. It shouldn't be a large lift to manually modify our local gem to take account for something as simple as that. I'll happily submit a proper pull request including a test case if it seems like all works well. Thanks again!

#4