Help config plugin output mail

Elastic Stack Logstash
1

I'm trying to configure the logstash to send the ERROR to my email

I use this:

email {
to => "fabioebner@gmail.com"
codec => "plain"
contenttype => "text/html; charset=UTF-8"
options => {
  smpt => {
    smtpIporHost => "smtp.gmail.com"
	port => 465
	userName => "user@gmail.com"
	password => "mypass"
	starttls => true
  }
}
}

But i got this error:

}
Errno::ECONNREFUSED: Connection refused - Connection refused
initialize at org/jruby/ext/socket/RubyTCPSocket.java:126
open at org/jruby/RubyIO.java:1179
tcp_socket at C:/java/logstash-1.5.2/vendor/jruby/lib/ruby/1.9/net/smtp.rb:541
do_start at C:/java/logstash-1.5.2/vendor/jruby/lib/ruby/1.9/net/smtp.rb:550
timeout at org/jruby/ext/timeout/Timeout.java:126
do_start at C:/java/logstash-1.5.2/vendor/jruby/lib/ruby/1.9/net/smtp.rb:550
start at C:/java/logstash-1.5.2/vendor/jruby/lib/ruby/1.9/net/smtp.rb:520
deliver! at C:/java/logstash-1.5.2/vendor/bundle/jruby/1.9/gems/mail-2.6.3/lib/mail/network/delivery_methods/smtp.rb:112
deliver! at C:/java/logstash-1.5.2/vendor/bundle/jruby/1.9/gems/mail-2.6.3/lib/mail/message.rb:252
receive at C:/java/logstash-1.5.2/vendor/bundle/jruby/1.9/gems/logstash-output-email-1.0.0/lib/logstash/outputs/email.rb:250
handle at C:/java/logstash-1.5.2/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.2.2-java/lib/logstash/outputs/base.rb:88
output_func at (eval):27
outputworker at C:/java/logstash-1.5.2/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.2.2-java/lib/logstash/pipeline.rb:243
start_outputs at C:/java/logstash-1.5.2/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.2.2-java/lib/logstash/pipeline.rb:165

2

i change the config to this:

email {
to => "fabioebner@gmail.com"
codec => "plain"
contenttype => "text/html; charset=UTF-8"
via => "smtp"
options => {
  smtpIporHost => "smtp.gmail.com"
  port => 465
  userName => "user@gmail.com"
  password => "mypass"
  starttls => true
}
}

but now i got this error:
Timeout::Error: Timeout::Error
rbuf_fill at C:/java/logstash-1.5.2/vendor/jruby/lib/ruby/1.9/net/protocol.rb:146
readuntil at C:/java/logstash-1.5.2/vendor/jruby/lib/ruby/1.9/net/protocol.rb:122
readline at C:/java/logstash-1.5.2/vendor/jruby/lib/ruby/1.9/net/protocol.rb:132
recv_response at C:/java/logstash-1.5.2/vendor/jruby/lib/ruby/1.9/net/smtp.rb:930
do_start at C:/java/logstash-1.5.2/vendor/jruby/lib/ruby/1.9/net/smtp.rb:553
critical at C:/java/logstash-1.5.2/vendor/jruby/lib/ruby/1.9/net/smtp.rb:940
do_start at C:/java/logstash-1.5.2/vendor/jruby/lib/ruby/1.9/net/smtp.rb:553
start at C:/java/logstash-1.5.2/vendor/jruby/lib/ruby/1.9/net/smtp.rb:520
deliver! at C:/java/logstash-1.5.2/vendor/bundle/jruby/1.9/gems/mail-2.6.3/lib/mail/network/delivery_methods/smtp.rb:112
deliver! at C:/java/logstash-1.5.2/vendor/bundle/jruby/1.9/gems/mail-2.6.3/lib/mail/message.rb:252
receive at C:/java/logstash-1.5.2/vendor/bundle/jruby/1.9/gems/logstash-output-email-1.0.0/lib/logstash/outputs/email.rb:250
handle at C:/java/logstash-1.5.2/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.2.2-java/lib/logstash/outputs/base.rb:88
output_func at (eval):27
outputworker at C:/java/logstash-1.5.2/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.2.2-java/lib/logstash/pipeline.rb:243
start_outputs at C:/java/logstash-1.5.2/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.2.2-java/lib/logstash/pipeline.rb:165

3 
email {
  to => "fabioebner@gmail.com"
  codec => "plain"
  contenttype => "text/html; charset=UTF-8"
  options => {
    smpt => {
      smtpIporHost => "smtp.gmail.com"
      port => 465
      userName => "user@gmail.com"
      password => "mypass"
      starttls => true
    }
  }
}

Do you really have "smpt" in your configuration file? Also, I think you're nesting your configuration too much. This should work better:

email {
  to => "fabioebner@gmail.com"
  codec => "plain"
  contenttype => "text/html; charset=UTF-8"
  options => {
    smtpIporHost => "smtp.gmail.com"
    port => 465
    userName => "user@gmail.com"
    password => "mypass"
    starttls => true
  }
}

If the starttls option as the name suggests selects whether to use STARTTLS or not I suspect you should be using port 587 instead. Port 465 is for SMTPS, i.e. SMTP over SSL.

(The documentation of the options parameter is really bad BTW. See https://github.com/logstash-plugins/logstash-output-email/issues/24.)

4

magnunsbaeck

Tks, works

but now the LS send one email from each line in my log

and how i put the error message in body of email?

tks

5

but now the LS send one email from each line in my log

Yes, that's expected if you don't wrap your output in a conditional.

and how i put the error message in body of email?

Set the body parameter and reference the field containing the error message.

email {
  body => "%{field-with-error-message}"
  ...
}
6

magnunsbaeck,

my config works fine, but i need send each event (winlogbeat critical events) at email and in elasticsearch index.
Can i configure .conf file to do this (send one event in two places) ?

7

Yes, your configuration can contain any number of outputs.

8

then i use:

input {
  beats {
    port => 5044
 } 
}

 output {
 if [type] == "wineventlog" and [level] == "_Warning" {
   email {
     to => "adm@xx.local"
     address => "192.168.1.5"
     from => "logstash@xx.loclal"
     subject => "Wineventlog Warning from: %{computer_name}"
     body => "%{log_name} event: %{message}"
    }
  }
  else if [type] == "wineventlog" and [level] == "_Error" {
   email {
     to => "adm@xx.local"
     address => "192.168.1.5"
     from => "logstash@xx.loclal"
     subject => "Wineventlog Error from: %{computer_name}"
     body => "%{log_name} event: %{message}"
    }
  }
 else{
    elasticsearch {
      hosts => "localhost:9200"
      index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
      document_type => "%{[@metadata][type]}"
    }
  }
}

i received filtered events by email, but loose it in index

9

That's expected with your configuration. Events that reach either of the email output will never reach the ES output. Don't use an else block here.

10

Magnus,

thanks for help!