# How to call a command from within a mutate email block then include the output in the email? **URL:** \ **Category:** Logstash\ **Created:** [December 14, 2016, 6:14pm UTC](https://discuss.elastic.co/t/how-to-call-a-command-from-within-a-mutate-email-block-then-include-the-output-in-the-email/69066 "2016-12-14T18:14:32Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![TomK](https://avatars.discourse-cdn.com/v4/letter/t/ee59a6/32.png) [@TomK](https://discuss.elastic.co/u/TomK)\ **Post date:** [December 14, 2016, 6:14pm UTC](https://discuss.elastic.co/t/how-to-call-a-command-from-within-a-mutate-email-block-then-include-the-output-in-the-email/69066/1 "2016-12-14T18:14:32Z")
(Rephrasing) We're trying to achieve the following: 1. Retrieve a UID from a log file entry / line. 2. Lookup that UID to get the real User Name. 3. Email the Log Entry / Line , the UID and the User Name (based on the UID) to a set of recipients. Currently trying the following, which does lookup but cannot get the Log Entry AND the looked up User Name to email out: if [key] == "transfer" { mutate { add\_tag =\> "email" } ruby { code =\> "event['userdetails'] = %x( /usr/bin/getent passwd event['uid'] )" } We looked at doing something like this: input { exec { command =\> '/usr/bin/getent passwd 2827362' } } but then we're not sure how to pass the output of the command into the email block to be sent out. The 'uid' is retrieved from a log file and we're trying to look up the user before sending the email. How can we achieve this? Cheers, Tom ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 15, 2016, 6:54am UTC](https://discuss.elastic.co/t/how-to-call-a-command-from-within-a-mutate-email-block-then-include-the-output-in-the-email/69066/2 "2016-12-15T06:54:25Z")
How about using a translate filter to map the uid to a username? A ruby filter similar to what you have above should also work but it clearly less efficient. ---
**Author:** ![TomK](https://avatars.discourse-cdn.com/v4/letter/t/ee59a6/32.png) [@TomK](https://discuss.elastic.co/u/TomK)\ **Post date:** [December 15, 2016, 7:09am UTC](https://discuss.elastic.co/t/how-to-call-a-command-from-within-a-mutate-email-block-then-include-the-output-in-the-email/69066/3 "2016-12-15T07:09:45Z")
Thanks Magnus, I agree. I would prefer an integrated solution, if possible. Could you please direct me to some materials that I could read on that or an example? Still relatively new to salt. I need to call this from inside the email block by passing a UID to the command, then reading the output and including it in the email I'm about to send. Cheers, Tom ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 15, 2016, 7:20am UTC](https://discuss.elastic.co/t/how-to-call-a-command-from-within-a-mutate-email-block-then-include-the-output-in-the-email/69066/4 "2016-12-15T07:20:15Z")
> Could you please direct me to some materials that I could read on that or an example? > **[Translate filter plugin | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-translate.html)** I'm sure the archives of these forums contain concrete examples. > Still relatively new to salt. Salt? > I need to call this from inside the email block by passing a UID to the command, then reading the output and including it in the email I'm about to send. The translate filter allows you to look up the uid and store the resulting username in another field. This field can then be referenced in your email output. ---
**Author:** ![TomK](https://avatars.discourse-cdn.com/v4/letter/t/ee59a6/32.png) [@TomK](https://discuss.elastic.co/u/TomK)\ **Post date:** [December 15, 2016, 3:52pm UTC](https://discuss.elastic.co/t/how-to-call-a-command-from-within-a-mutate-email-block-then-include-the-output-in-the-email/69066/5 "2016-12-15T15:52:19Z")
Sorry about that. Logstash. While writing this I was talking with someone about salt and the word slipped in. ☹ ---
**Author:** ![TomK](https://avatars.discourse-cdn.com/v4/letter/t/ee59a6/32.png) [@TomK](https://discuss.elastic.co/u/TomK)\ **Post date:** [December 16, 2016, 2:34pm UTC](https://discuss.elastic.co/t/how-to-call-a-command-from-within-a-mutate-email-block-then-include-the-output-in-the-email/69066/6 "2016-12-16T14:34:51Z")
Magnus, in your reply, I'm thinking you're only referring to the conversion of the UID to a username, not the rest of my questions? This also looks like a static assignment that's possible via the translate functions not something where we can pass a UID variable to translate and it goes and looks up the user on the system. We do not know what the UID will be and need to look that up dynamically. (I've edited and clarified the original ask above.) Cheers, Tom ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 16, 2016, 6:41pm UTC](https://discuss.elastic.co/t/how-to-call-a-command-from-within-a-mutate-email-block-then-include-the-output-in-the-email/69066/7 "2016-12-16T18:41:40Z")
If the mappings really can't be static you could, as I said, use a ruby filter that runs the command to dynamically make the mapping. If that isn't performant enough, perhaps you can run an external service and use a ruby filter to query that service via e.g. HTTP? ---
**Author:** ![TomK](https://avatars.discourse-cdn.com/v4/letter/t/ee59a6/32.png) [@TomK](https://discuss.elastic.co/u/TomK)\ **Post date:** [December 17, 2016, 3:02am UTC](https://discuss.elastic.co/t/how-to-call-a-command-from-within-a-mutate-email-block-then-include-the-output-in-the-email/69066/8 "2016-12-17T03:02:05Z")
Allright, will try a Ruby filter. Thanks Magnus. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 14, 2017, 3:02am UTC](https://discuss.elastic.co/t/how-to-call-a-command-from-within-a-mutate-email-block-then-include-the-output-in-the-email/69066/9 "2017-01-14T03:02:19Z")
Closed on January 14, 2017, 3:02am UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.