Email body is it not evaluating %{message}

Elastic Stack Logstash
1 
input {
jdbc {
...
...
 statement => "SELECT 70 as value"
}
}    output {

stdout { codec => rubydebug }

	email {
          authentication => 'login' 
          from => 'whatever@xxx.com'
          domain => 'xxx.com'         
          address  => 'xxx.com'         
      		to => 'juan.xxx@gxxx.com'
      		port => 25
      		username => 'xxx@xxx.com'
			    password => 'yyy'   
          subject => 'Alert - %{title}'
          body => "Tags: %{tags}\n Content: \n %{message} "   
    	}
}

I have an output email plugin ... and %{message} it is not evaluating / binding ... I'm getting the text "%{message}."

Any clue ? I'm using logstash 6.0.1

this is the output of stdout

{
      "@version" => "1",
    "@timestamp" => 2017-12-11T21:12:44.158Z,
         "value" => 70,
          "tags" => [
        [0] "should_email",
        [1] "loans"
    ]
}
2

This indicates that the event doesn't have a message field.

3

I updated the post with more code. If I have an output of stdout, I have message, right ?

4

I updated the post with more code. If I have an output of stdout, I have message, right ?

No. The output you posted clearly shows that you only have four fields (@timestamp, @version, value, and tags). This isn't surprising since you're only selecting a single column in your jdbc input. I don't know what you expect to get in the email.

5

I see my error now ! Thank you for the clarification !

Is possible to refer all fields ? for example if I want to send rubydebug output or codec as json.

6

I don't think it's possible out of the box; you'll have to assemble a temporary field (e.g. in a subfield of @metadata) containing the data you need. You could use a ruby filter to do that.

7

got you, thank you @magnusbaeck !

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.