# Email alert for message in tag

**URL:** <https://discuss.elastic.co/t/email-alert-for-message-in-tag/145162>\
**Category:** Logstash\
**Created:** [August 20, 2018, 12:38pm UTC](https://discuss.elastic.co/t/email-alert-for-message-in-tag/145162 "2018-08-20T12:38:49Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![WarrenG](https://avatars.discourse-cdn.com/v4/letter/w/a5b964/32.png) [@WarrenG](https://discuss.elastic.co/u/WarrenG)\
**Post date:** [August 20, 2018, 12:38pm UTC](https://discuss.elastic.co/t/email-alert-for-message-in-tag/145162/1 "2018-08-20T12:38:49Z")

</div>

Hi All

First try with emailing logs, I found this bit of information but im having issues working out how this would work for me.

```auto
    if "FOUND" in [message] {
        email {
            from => "logstash_alert@company.local"
            subject => "logstash alert"
            to => "myemail@company.local"
            via => "smtp"
            body => "Here is the event line that occured: %{message}"
        }
    }

```

My problem is that "found" is around quite a lot, I only want the email if the word "FOUND" is in a specific logfile / tag

is that possible?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 20, 2018, 12:46pm UTC](https://discuss.elastic.co/t/email-alert-for-message-in-tag/145162/2 "2018-08-20T12:46:38Z")

</div>

Yes. If you have fields for the logfile you can just add that as a restriction in your condition.

```
if [filename] == "whatever" and "FOUND" in [message] {
```

---

<div class="post-metadata">

**Author:** ![WarrenG](https://avatars.discourse-cdn.com/v4/letter/w/a5b964/32.png) [@WarrenG](https://discuss.elastic.co/u/WarrenG)\
**Post date:** [August 20, 2018, 1:51pm UTC](https://discuss.elastic.co/t/email-alert-for-message-in-tag/145162/3 "2018-08-20T13:51:58Z")

</div>

Hi Magnus

```auto
[root@develk01 conf.d]# cat 30-elasticsearch-output.conf
output {
 elasticsearch {
    hosts => ["localhost:9200"]
    sniffing => true
    manage_template => false
    index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  }
  if [filename] == "clamd.log" and "FOUND" in [message] {
        email {
            from => "logstash_alert@xxx"
            subject => "logstash alert"
            to => "xxx@xxx"
            via => "smtp"
            body => "Here is the event line that occured: %{message}"
            domain => 'smtp.xxx'
            port => 25
        }
    }
}
[root@develk01 conf.d]

```

I then forced a run to create the log which showed up in Kibana, but no email. I also didnt see anything in the logstash logs, any idea what I have done wrong?

Logs from the server running the scan:

```auto
Starting ClamAV Scan at Mon 20 Aug 14:40:12 IST 2018
Mon Aug 20 14:45:35 2018 -> SelfCheck: Database status OK.
/home/adm-guerinw@xxx/test.virus: Eicar-Test-Signature FOUND

```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 20, 2018, 1:55pm UTC](https://discuss.elastic.co/t/email-alert-for-message-in-tag/145162/4 "2018-08-20T13:55:36Z")

</div>

What does the event that Logstash should've sent in an email look like? Copy/paste from Kibana's JSON tab.

Have you verified that email sending is working at all?

---

<div class="post-metadata">

**Author:** ![WarrenG](https://avatars.discourse-cdn.com/v4/letter/w/a5b964/32.png) [@WarrenG](https://discuss.elastic.co/u/WarrenG)\
**Post date:** [August 20, 2018, 1:56pm UTC](https://discuss.elastic.co/t/email-alert-for-message-in-tag/145162/5 "2018-08-20T13:56:30Z")

</div>

I have not verified email sending is working at all, is there a link you can send on that explains that bit?

Thank you

---

<div class="post-metadata">

**Author:** ![WarrenG](https://avatars.discourse-cdn.com/v4/letter/w/a5b964/32.png) [@WarrenG](https://discuss.elastic.co/u/WarrenG)\
**Post date:** [August 20, 2018, 1:57pm UTC](https://discuss.elastic.co/t/email-alert-for-message-in-tag/145162/6 "2018-08-20T13:57:18Z")

</div>

```auto
{
  "_index": "filebeat-6.3.2-2018.08.20",
  "_type": "doc",
  "_id": "yDGXV2UBVdeQSjnxZNoW",
  "_score": 1,
  "_source": {
    "offset": 113051,
    "source": "/var/log/clamd.log",
    "@timestamp": "2018-08-20T13:47:36.875Z",
    "input": {
      "type": "log"
    },
    "message": "/home/adm-guerinw@xxx/test.virus: Eicar-Test-Signature FOUND",
    "host": {
      "name": "devavdb01"
    },
    "beat": {
      "name": "devavdb01",
      "version": "6.3.2",
      "hostname": "devavdb01"
    },
    "prospector": {
      "type": "log"
    },
    "tags": [
      "clamav",
      "beats_input_codec_plain_applied"
    ],
    "@version": "1"
  },
  "fields": {
    "@timestamp": [
      "2018-08-20T13:47:36.875Z"
    ]
  }
}

```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 20, 2018, 2:01pm UTC](https://discuss.elastic.co/t/email-alert-for-message-in-tag/145162/7 "2018-08-20T14:01:32Z")

</div>

That event doesn't have a `filename` field so the conditional surrounding the email output is obviously never true. You do have a `source` field though.

---

<div class="post-metadata">

**Author:** ![WarrenG](https://avatars.discourse-cdn.com/v4/letter/w/a5b964/32.png) [@WarrenG](https://discuss.elastic.co/u/WarrenG)\
**Post date:** [August 20, 2018, 2:04pm UTC](https://discuss.elastic.co/t/email-alert-for-message-in-tag/145162/8 "2018-08-20T14:04:31Z")

</div>

```auto
  if [source] == "/var/log/clamd.log" and "FOUND" in [message]
```

---

<div class="post-metadata">

**Author:** ![WarrenG](https://avatars.discourse-cdn.com/v4/letter/w/a5b964/32.png) [@WarrenG](https://discuss.elastic.co/u/WarrenG)\
**Post date:** [August 20, 2018, 2:05pm UTC](https://discuss.elastic.co/t/email-alert-for-message-in-tag/145162/9 "2018-08-20T14:05:29Z")

</div>

or could I have:

```auto
  if [tag] == "clamav" and "FOUND" in [message]
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 20, 2018, 2:06pm UTC](https://discuss.elastic.co/t/email-alert-for-message-in-tag/145162/10 "2018-08-20T14:06:31Z")

</div>

The existence of a tag is checked like this:

```
if "clamav" in [tags] ...
```

---

<div class="post-metadata">

**Author:** ![WarrenG](https://avatars.discourse-cdn.com/v4/letter/w/a5b964/32.png) [@WarrenG](https://discuss.elastic.co/u/WarrenG)\
**Post date:** [August 20, 2018, 2:17pm UTC](https://discuss.elastic.co/t/email-alert-for-message-in-tag/145162/11 "2018-08-20T14:17:38Z")

</div>

Brilliant, I think this is a better error to have now!

```auto
[2018-08-20T15:14:51,727][ERROR][logstash.outputs.email] Something happen while delivering an email {:exception=>#<Errno::ECONNREFUSED: Connection refused - connect(2) for "localhost" port 25>}

```

Ill work on that one now.

Thank you for your help!

---

<div class="post-metadata">

**Author:** ![WarrenG](https://avatars.discourse-cdn.com/v4/letter/w/a5b964/32.png) [@WarrenG](https://discuss.elastic.co/u/WarrenG)\
**Post date:** [August 20, 2018, 2:36pm UTC](https://discuss.elastic.co/t/email-alert-for-message-in-tag/145162/12 "2018-08-20T14:36:30Z")

</div>

Hi Magnus

do I have to use a local smtp, can I use an external SMTP server? I can connect on port 25 with no authentication to my external smtp.

Thank you

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 20, 2018, 7:09pm UTC](https://discuss.elastic.co/t/email-alert-for-message-in-tag/145162/13 "2018-08-20T19:09:41Z")

</div>

Logstash can connect to any SMTP server.

---

<div class="post-metadata">

**Author:** ![WarrenG](https://avatars.discourse-cdn.com/v4/letter/w/a5b964/32.png) [@WarrenG](https://discuss.elastic.co/u/WarrenG)\
**Post date:** [August 21, 2018, 7:30am UTC](https://discuss.elastic.co/t/email-alert-for-message-in-tag/145162/14 "2018-08-21T07:30:37Z")

</div>

Thanks Magnus, this is now working and I received an email last night, my config:

```auto
  if "clamav" in [tags] and "FOUND" in [message] {
        email {
            from => "logstash_alert@xxx.com"
            subject => "logstash alert"
            to => "xxx@xxx.com"
            via => "smtp"
            body => "Here is the event line that occured: %{message}"
            address => "smtp.xxx.com"
            port => 25
        }
    }

```

Thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 18, 2018, 7:30am UTC](https://discuss.elastic.co/t/email-alert-for-message-in-tag/145162/15 "2018-09-18T07:30:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.