# Email configuration in logstash **URL:** \ **Category:** Logstash\ **Created:** [June 2, 2015, 5:02pm UTC](https://discuss.elastic.co/t/email-configuration-in-logstash/1760 "2015-06-02T17:02:33Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![gaurav2090](https://avatars.discourse-cdn.com/v4/letter/g/5e9695/32.png) [@gaurav2090](https://discuss.elastic.co/u/gaurav2090)\ **Post date:** [June 2, 2015, 5:02pm UTC](https://discuss.elastic.co/t/email-configuration-in-logstash/1760/1 "2015-06-02T17:02:33Z")
Hi, Below is my configuration file filter { if [type] == "sftp\_authlog" { grok { pattern =\> "%{SYSLOGTIMESTAMP:timestamp} %{HOSTNAME:host\_target} sshd[%{BASE10NUM}]: Failed password for (invalid user |)%{USERNAME:username} from %{IP:src\_ip} port %{BASE10NUM:port} ssh2" # match =\> { "message" =\> "fail" } } } } output { elasticsearch { host =\> localhost } stdout { codec =\> rubydebug } email { #type =\> "sftp\_authlog" match =\> ["fail","%{@message}"] # match =\> { "message" =\> "fail" } match =\>["messageAndSourceMatch", "@message,_fail_"] to =\> "[gaurav.gurani@xyz.com](mailto:gaurav.gurani@xyz.com)" from =\> "[logstash@xyz.com](mailto:logstash@xyz.com)" options =\> ["smtpIporHost", "x.x.x.x","port", "xx"] #from =\> "[logstash@hcentive.com](mailto:logstash@hcentive.com)" subject =\> "Found '%{matchName}' Alert on %{@source\_host}" #to =\> "[gaurav.gurani@hcentive.com](mailto:gaurav.gurani@hcentive.com)" body =\> "Here is the event line that occured: %{@message}" htmlbody =\> " ## %{matchName} ### Full Event %{@message} " } } sftp\_authlog- this is catching logs from remote host(with logstash-forwarder) and i am applying filter in logstash server.i am not able to receive the mails from above config .but when i am commenting the match inside email block then mail is coming but that was blank mail Requirement :- i want to receive from logstash when certain login failure attempted ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 2, 2015, 5:09pm UTC](https://discuss.elastic.co/t/email-configuration-in-logstash/1760/2 "2015-06-02T17:09:31Z")
Could you edit your post to make it more readable? It's hard to understand exactly what your configuration looks like. Select the text and click the "Preformatted text" button in the toolbar or press Ctrl+K. What version of Logstash is this? You're using a couple of constructs that aren't supported in reasonably recent versions. ---
**Author:** ![gaurav2090](https://avatars.discourse-cdn.com/v4/letter/g/5e9695/32.png) [@gaurav2090](https://discuss.elastic.co/u/gaurav2090)\ **Post date:** [June 2, 2015, 5:18pm UTC](https://discuss.elastic.co/t/email-configuration-in-logstash/1760/3 "2015-06-02T17:18:32Z")
Hi, Below are my conf files ``` file inside logstash server 192.168.0.1 filter { if [type] == "sftp_authlog" { grok { pattern => "%{SYSLOGTIMESTAMP:timestamp} %{HOSTNAME:host_target} sshd\[%{BASE10NUM}\]: Failed password for (invalid user |)%{USERNAME:username} from %{IP:src_ip} port %{BASE10NUM:port} ssh2" match => { "message" => "fail" } } } } output { elasticsearch { host => localhost } stdout { codec => rubydebug } email { match => [ "fail","%{@message}" to => "" from => "" options => ["smtpIporHost", "192.168.0.25","port", "25"] subject => "Found '%{matchName}' Alert on %{@source_host}" body => "Here is the event line that occured: %{@message}" htmlbody => "

%{matchName}



Full Event



%{@message}
" } } ---------------------------------------------------------------------------------------- logstash version:-logstash 1.4.2-modified --------------------------------------------------------------------------------------- Logstash-forwarder.conf IP of logstash forwarder 192.168.0.2 { "network": { "servers": ["192.168.0.1:5000"], "timeout": 15, "ssl certificate": "/etc/pki/tls/apache.star.hcentive.com.crt", "ssl key": "/etc/pki/tls/nopwd.key", "ssl ca": "/home/mustafa/gd_bundle-g2-g1.crt", "ssl strict verify": "false" }, "files": [ { "paths": [ "/var/log/auth.log" ], "fields": { "type": "sftp_authlog" } } ] } ``` ---
**Author:** ![gaurav2090](https://avatars.discourse-cdn.com/v4/letter/g/5e9695/32.png) [@gaurav2090](https://discuss.elastic.co/u/gaurav2090)\ **Post date:** [June 2, 2015, 5:22pm UTC](https://discuss.elastic.co/t/email-configuration-in-logstash/1760/4 "2015-06-02T17:22:01Z")
and first of all thanx a lot for quick respose ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 2, 2015, 6:02pm UTC](https://discuss.elastic.co/t/email-configuration-in-logstash/1760/5 "2015-06-02T18:02:46Z")
...and what version of Logstash? ---
**Author:** ![gaurav2090](https://avatars.discourse-cdn.com/v4/letter/g/5e9695/32.png) [@gaurav2090](https://discuss.elastic.co/u/gaurav2090)\ **Post date:** [June 3, 2015, 9:11am UTC](https://discuss.elastic.co/t/email-configuration-in-logstash/1760/6 "2015-06-03T09:11:16Z")
logstash version:-logstash 1.4.2-modified ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 3, 2015, 10:20am UTC](https://discuss.elastic.co/t/email-configuration-in-logstash/1760/7 "2015-06-03T10:20:20Z")
Okay. That might've worked for older releases of Logstash (I only know 1.4 and 1.5) but for 1.4 there's a lot of craziness in there that just doesn't work. What's it _supposed_ to do? Are you trying to send the email conditionally? On what condition? ---
**Author:** ![gaurav2090](https://avatars.discourse-cdn.com/v4/letter/g/5e9695/32.png) [@gaurav2090](https://discuss.elastic.co/u/gaurav2090)\ **Post date:** [June 3, 2015, 12:27pm UTC](https://discuss.elastic.co/t/email-configuration-in-logstash/1760/8 "2015-06-03T12:27:44Z")
i want to send mail alerts when "authentication failure" string found in auth logs ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 3, 2015, 12:49pm UTC](https://discuss.elastic.co/t/email-configuration-in-logstash/1760/9 "2015-06-03T12:49:03Z")
Oh. That's easy: ``` output { if "authentication failure" in [message] { email { ... } } } ``` ---
**Author:** ![gaurav2090](https://avatars.discourse-cdn.com/v4/letter/g/5e9695/32.png) [@gaurav2090](https://discuss.elastic.co/u/gaurav2090)\ **Post date:** [June 3, 2015, 2:28pm UTC](https://discuss.elastic.co/t/email-configuration-in-logstash/1760/10 "2015-06-03T14:28:07Z")
``` This i have to write in output file along with filters? or i have to write in separate file. Is this correct?? ``` **Please check below file** ``` filter { if [type] == "sftp_authlog" { grok { pattern => "%{SYSLOGTIMESTAMP:timestamp} %{HOSTNAME:host_target} sshd\[%{BASE10NUM}\]: Failed password for (invalid user |)%{USERNAME:username} from %{IP:src_ip} port %{BASE10NUM:port} ssh2" match => { "message" => "fail" } } } } output { elasticsearch { host => localhost } # stdout { } stdout { codec => rubydebug } if "authentication failure" in [message] { email { #type => "sftp_authlog" #match => ["fail","%{@message}"] # match => { "message" => "fail" } match =>["messageAndSourceMatch", "@message,*fail*"] to => "" from => "" options => ["smtpIporHost", "10.10.0.111","port", "25"] #from => "" subject => "Found '%{matchName}' Alert on %{@source_host}" #to => "" body => "Here is the event line that occured: %{@message}" htmlbody => "

Full Event



%{@message}
" } }} ``` ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 3, 2015, 2:44pm UTC](https://discuss.elastic.co/t/email-configuration-in-logstash/1760/11 "2015-06-03T14:44:30Z")
Your grok filter should look like this: ``` grok { match => [ "message", "%{SYSLOGTIMESTAMP:timestamp} %{HOSTNAME:host_target} sshd\[%{BASE10NUM}\]: Failed password for (invalid user |)%{USERNAME:username} from %{IP:src_ip} port %{BASE10NUM:port} ssh2" ] } ``` Other comments: - References to the fields `@message` and `@source_host` are incorrect. Those are legacy field names that aren't used in Logstash 1.4. Use `message` and `host` instead. - There's no `match` parameter to the email output. ---
**Author:** ![asifalis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/asifalis/32/6478_2.png) [@asifalis](https://discuss.elastic.co/u/asifalis)\ **Post date:** [May 11, 2016, 7:14pm UTC](https://discuss.elastic.co/t/email-configuration-in-logstash/1760/12 "2016-05-11T19:14:27Z")
Hi Magnusbaeck, I apply that condition which you mentioned like following, but I received alot alert in email even match single word or multiple alphabet, like au\* or fai, I just want to logstash just alert on specific word ! "authentication" , your help would be appreciated . output { if "authentication failure" in [message] { email { ... } } } ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 11, 2016, 9:27pm UTC](https://discuss.elastic.co/t/email-configuration-in-logstash/1760/13 "2016-05-11T21:27:59Z")
@asifalis, please start a new thread for your unrelated problem. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:58am UTC](https://discuss.elastic.co/t/email-configuration-in-logstash/1760/14 "2017-07-06T04:58:05Z")