# Get the input csv file path or filename in email

**URL:** <https://discuss.elastic.co/t/get-the-input-csv-file-path-or-filename-in-email/103929>\
**Category:** Logstash\
**Created:** [October 13, 2017, 4:20pm UTC](https://discuss.elastic.co/t/get-the-input-csv-file-path-or-filename-in-email/103929 "2017-10-13T16:20:42Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![surajbs](https://avatars.discourse-cdn.com/v4/letter/s/e68b1a/32.png) [@surajbs](https://discuss.elastic.co/u/surajbs)\
**Post date:** [October 13, 2017, 4:20pm UTC](https://discuss.elastic.co/t/get-the-input-csv-file-path-or-filename-in-email/103929/1 "2017-10-13T16:20:43Z")

</div>

Hi,

How can we get the input csv file path or filename in email.

Below is my config for the input and output:  
input {  
file {  
path =\> "path to file/\*.csv"  
type =\> "csv"  
start\_position =\> beginning  
}  
file {  
path =\> "path to log/logstash-plain.log"  
type =\> "syslog"  
sincedb\_path =\> "null"

filter{}

output  
{  
if [type] == "csv"  
{   
elasticsearch {  
hosts =\> "localhost:9200"  
index =\> "cmss"  
document\_type =\> "cms"  
document\_id =\> "%{id}"  
}  
}  
if [type] == "syslog"  
{  
if "[ERROR]" in [message]  
{  
email {  
address =\> ".........................."  
subject =\> "logstash alert"  
to =\> "......................."  
body =\> "%{message}"  
}  
}  
}

Any idea or support would be really helpful.

Thank you.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 17, 2017, 5:32am UTC](https://discuss.elastic.co/t/get-the-input-csv-file-path-or-filename-in-email/103929/2 "2017-10-17T05:32:10Z")

</div>

So what happens? Is there anything in the logs?

> if "[ERROR]" in [message]

There's an extra space after "ERROR".

---

<div class="post-metadata">

**Author:** ![surajbs](https://avatars.discourse-cdn.com/v4/letter/s/e68b1a/32.png) [@surajbs](https://discuss.elastic.co/u/surajbs)\
**Post date:** [October 17, 2017, 6:52pm UTC](https://discuss.elastic.co/t/get-the-input-csv-file-path-or-filename-in-email/103929/3 "2017-10-17T18:52:48Z")

</div>

Hi Magnus,

That's how that ERROR with extra space gets log into the logstash log file. And it emails if log file gets any ERROR tag message.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 17, 2017, 7:07pm UTC](https://discuss.elastic.co/t/get-the-input-csv-file-path-or-filename-in-email/103929/4 "2017-10-17T19:07:53Z")

</div>

You should be able to find the input filename in the `path` field so you can just reference that field in the email output's `body` option just like you're currently doing with the `message` field.

---

<div class="post-metadata">

**Author:** ![surajbs](https://avatars.discourse-cdn.com/v4/letter/s/e68b1a/32.png) [@surajbs](https://discuss.elastic.co/u/surajbs)\
**Post date:** [October 18, 2017, 3:07pm UTC](https://discuss.elastic.co/t/get-the-input-csv-file-path-or-filename-in-email/103929/5 "2017-10-18T15:07:19Z")

</div>

Yes, I tried with the same way, which you can see below, But it sends multiple emails with the path according to the number of document or rows of loading file.

output  
{  
if [type] == "csv"  
{   
elasticsearch {  
hosts =\> "localhost:9200"  
index =\> "cmss"  
document\_type =\> "cms"  
document\_id =\> "%{id}"  
}  
email {  
address =\> ".........................."  
subject =\> "logstash alert"  
to =\> "......................."  
body =\> "%{path}"  
}  
}  
if [type] == "syslog"  
{  
if "[ERROR]" in [message]  
{  
email {  
address =\> ".........................."  
subject =\> "logstash alert"  
to =\> "......................."  
body =\> "%{message}"  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 18, 2017, 3:28pm UTC](https://discuss.elastic.co/t/get-the-input-csv-file-path-or-filename-in-email/103929/6 "2017-10-18T15:28:44Z")

</div>

> But it sends multiple emails with the path according to the number of document or rows of loading file.

Yes, that's expected.

Using Logstash for this kind of alerts is a fundamentally bad idea. Look into ElastAlert, Elastic's own Watcher, or perhaps Grafana instead.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 15, 2017, 3:28pm UTC](https://discuss.elastic.co/t/get-the-input-csv-file-path-or-filename-in-email/103929/7 "2017-11-15T15:28:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.