Hi there,
i wanted to have email Notifications when some issues appears.
I created such Output:
output {
elasticsearch {
hosts => ["10.10.5.100:9200"]
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
if "CRITICAL" in [log_type] or "500" in [nginx.access.response_code] or "404" in [nginx.access.response_code] {
email {
from => "logging@localhost"
to => "daniel@linux-nerd.de"
subject => "Logstash found an error"
body => "ERROR: For more details take a look into Kibana. The message from logstash input: %{message}"
}
}
}
Logstash will shift all data to Elasticsearch but did not send any eMails which these rules.
Could someone tell me where my mistake is?
Cheers
Daniel