I want to compare two fields both are double type which I checked using this url
http://localhost:9200/logstash-*/_mapping?pretty
and I wrote like this in my logstash config file
if [field1] > [field2]
{
email {
from => "testmail"
subject => "logstash alert"
to => "testmail"
via => "smtp"
body => "This is new vandanatest for new condition %{field1}"
}
}
if i send mail without if condition I always receive an email but never enters into this condition ,this condition is true I check manually . Is there any syntactical error in this ?
The fields might be mapped as float fields in Elasticsearch, but are they float fields in the Logstash event? Please show the result of a stdout { codec => rubydebug } output for an event that didn't trigger an email.
(Side note: I do not recommend using Logstash for alerting like this.)
hello I am getting this error when I use > this event
NoMethodError: undefined method `>' for nil:NilClass but without this event sample output is here
{
"message" => "connected_slaves:0\r",
"@version" => "1",
"@timestamp" => "2016-07-28T05:27:43.687Z",
"type" => "replication",
"host" => "N11DTHDM0008",
"command" => "redis-cli info replication",
"connected_slaves" => 0.0
}
{
"message" => "master_repl_offset:0\r",
"@version" => "1",
"@timestamp" => "2016-07-28T05:27:43.687Z",
"type" => "replication",
"host" => "N11DTHDM0008",
"command" => "redis-cli info replication",
"master_repl_offset" => 0.0
}
{
"message" => "used_cpu_sys:0.51\r",
"@version" => "1",
"@timestamp" => "2016-07-28T05:27:43.673Z",
"type" => "cpu",
"host" => "N11DTHDM0008",
"command" => "redis-cli info cpu",
"used_cpu_sys" => 0.51
}
And can you please explain why alerting is not recommendable as I don't know much about that
hello I am getting this error when I use > this event
NoMethodError: undefined method `>' for nil:NilClass
That probably means that the field you're trying to compare with something doesn't exist.
but without this event sample output is here
Assuming connected_slaves, master_repl_offset, and used_cpu_sys are the fields you're referencing in your conditional things are looking good.
And can you please explain why alerting is not recommendable as I don't know much about that
Logstash isn't an alerting system so it lacks features that real alerting systems have. For example, it won't send you a single message when a threshold has been met (so unless you're careful it'll flood you with messages), there's no way to silence alerts, etc.
But I can see the fields in kibana under available fields have a look on my config
input {
exec {
command => "redis-cli info clients"
interval => 4
type => "clients"
}
exec {
command => "cat /proc/meminfo"
type => "sysmem"
interval => 4
}
exec {
command => "redis-cli info memory"
interval => 4
type => "memory"
}
exec {
command => "redis-cli info cpu"
interval => 4
type => "cpu"
}
exec {
command => "redis-cli info stats"
interval => 4
type => "stats"
}
exec {
command => "redis-cli info replication"
interval => 4
type => "replication"
}
}
filter {
split {
}
ruby {
code => "fields = event['message'].split(':')
event[fields[0]] = fields[1].to_f
"
}
}
output {
elasticsearch {
hosts => ["localhost:9200"]
}
if [MemFree] and [used_memory_human]
{
if [MemFree] > [used_memory_human]
{
}
}
stdout { codec => rubydebug}
}
What does an event with the MemFree and used_memory_human fields look like? Do those fields actually exist in the same event?
No these fields are generated because of redis commands basically I want to compare redis memory and system memory
How they're generated matters less. What does matter is that Logstash can't compare fields in different events. Each event is processed by the filters independently from other events. There are a few filters that make exceptions to this general rule and you might be able to use the aggregate filter to do what you need, but then I think you'd be bending Logstash too far.
If you're sending all the data to Elasticsearch a better approach would be to write a script that queries ES for the latest metric of each kind and makes the comparison. I believe the Watcher product would be capable of this.