E-mail plugin conditional expression

Elastic Stack Logstash
1

Hello,

I'm trying to configure the e-mail plugin for Topbeat.
I would like to receive an e-mail when the variable fs.used_p is greather than 70%.
However the sintax is not working for the conditional:

if [fs][used_p] >= "0.7" {

This is my output file:

output {
elasticsearch {
hosts => ["..."]
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}

if [fs][used_p] >= "0.7" {
email {
address => "..."
port => 25
authentication => "plain"
from => "..."
subject => "%{[fs][used_p]} - %{[beat][hostname]} %{[fs][mount_point]}"
to => "..."
via => "smtp"
htmlbody => "
...
"
}
}
}

I'm missing or doing something wrong?

Thanks in advance.

2

Your conditional needs to look like this:

if [fs][used_p] >= 0.7 {

This assumes that the [fs][used_p] field is numeric rather than a string.

3

When put this: if [fs][used_p] >= 0.7 {

I receive lots of TIME_WAIT:

:/opt/logstash/conf.d.topbeat# netstat -na | grep 5045
tcp 0 0 53.8.125.71:5045 53.8.125.71:41939 TIME_WAIT
tcp 0 0 53.8.125.71:5045 53.8.125.118:38029 TIME_WAIT
tcp 0 0 53.8.125.71:5045 53.8.124.153:50989 TIME_WAIT
tcp 0 0 53.8.125.71:5045 53.8.144.119:49096 TIME_WAIT
tcp 0 0 53.8.125.71:5045 53.8.144.122:39336 TIME_WAIT
tcp 0 0 53.8.125.71:5045 53.8.124.154:35232 TIME_WAIT

After a while the Logstash finishes.

If I put for example: if [type] == "filesystem" {

It works and I receive the e-mails.

That's why I guess I'm missing something.

4

I've noticed that if I put:

if [fs][used_p] == 0.0 {

It works.

Does anybody know if the equality conditional ">=" really works for this case?

5

Any idea?

6

Unfortunately I still with no answer. I don't know what to do.

7

I was trying to use the follow conditional:

if [fs][used_p] >= 0.7 {

However, it didn't work. After many searchs we have discovered that some values on the fs.used_p variable are null.
So, when it try to campare an error is given.

To fix this it is necessary to use the follow expression:

if [fs][used_p] and [fs][used_p] >= 0.7 {

First the variable is validated (if is null or not) than the conditional is made.

Now It's working and we are receiving the e-mails as expected.