# How to send an email using logstash only if your log message has particular string

**URL:** <https://discuss.elastic.co/t/how-to-send-an-email-using-logstash-only-if-your-log-message-has-particular-string/179197>\
**Category:** Logstash\
**Tags:** elastic-stack-alerting\
**Created:** [May 1, 2019, 11:16am UTC](https://discuss.elastic.co/t/how-to-send-an-email-using-logstash-only-if-your-log-message-has-particular-string/179197 "2019-05-01T11:16:21Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![irobot678](https://avatars.discourse-cdn.com/v4/letter/i/54ee81/32.png) [@irobot678](https://discuss.elastic.co/u/irobot678)\
**Post date:** [May 1, 2019, 11:16am UTC](https://discuss.elastic.co/t/how-to-send-an-email-using-logstash-only-if-your-log-message-has-particular-string/179197/1 "2019-05-01T11:16:21Z")

</div>

HI ,

My requirement is to email the logs that match only a particular sub string in a message .

By removing the if condition in the below code i am able to receive email notification which means the code is working but i need email notification only for the logs that has a particular sub string. Can someone please help me solve it

logstash.conf

input {  
file {  
path =\> "/home/c.log"  
start\_position =\> "beginning"  
}  
}  
filter {

grok {  
match =\> ["message","%{GREEDYDATA:message}"]

}

}  
output {  
stdout { codec =\> rubydebug }  
if "java.lang.RuntimeException" in [message] {  
email {  
from =\> "##########.com"  
body =\> "Here is the event :%{message} \nLog file: %{path}"  
to =\> "v#######@gmail.com"

```
    codec => "plain"
    contenttype => "text/plain; charset=UTF-8"

    address => "smtp.gmail.com"
    port => "587"
    authentication => "plain"
    username => "########@gmail.com"
    password => "mypassword"
    use_tls => true
    debug => true
  }

```

}  
}

sample log

Caused by: java.lang.RuntimeException: java.io.IOException: Bad Base64 input character decimal 69 in array position 35

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 1, 2019, 1:34pm UTC](https://discuss.elastic.co/t/how-to-send-an-email-using-logstash-only-if-your-log-message-has-particular-string/179197/2 "2019-05-01T13:34:45Z")

</div>

> [@irobot678](#):
>
> if "java.lang.RuntimeException" in [message] {

This works for me. If I feed logstash a file which contains several lines of random text plus your sample message I only get the sample message output.

---

<div class="post-metadata">

**Author:** ![irobot678](https://avatars.discourse-cdn.com/v4/letter/i/54ee81/32.png) [@irobot678](https://discuss.elastic.co/u/irobot678)\
**Post date:** [May 1, 2019, 2:13pm UTC](https://discuss.elastic.co/t/how-to-send-an-email-using-logstash-only-if-your-log-message-has-particular-string/179197/3 "2019-05-01T14:13:44Z")

</div>

HI badger ,

i tried but its not working have a look at my conf file and console logs

CASE 1 :  
logstash.conf  
input {  
file {  
path =\> "/home/c.log"  
start\_position =\> "beginning"  
}  
}  
filter {

grok {

> match =\> ["message","%{GREEDYDATA:message}"]

}  
output {  
stdout { codec =\> rubydebug }  
if "java.lang.RuntimeException" in [message] {  
email {  
from =\> "#########@gmail.com"  
body =\> "Here is the event :%{message} \nLog file: %{path}"  
to =\> "######@gmail.com"  
codec =\> "plain"  
contenttype =\> "text/plain; charset=UTF-8"

```
address => "smtp.gmail.com"
port => "587"
authentication => "plain"
username => "########@gmail.com"
password => "mypassword"
use_tls => true
debug => true

```

}  
}  
}

console output :

{  
"path" =\> "/home/Desktop/a.log",  
"message" =\> [  
[0] "Caused by: java.lang.RuntimeException: java.io.IOException: Bad Base64 input character decimal 61 in array position 31",  
[1] "Caused by: java.lang.RuntimeException: java.io.IOException: Bad Base64 input character decimal 61 in array position 31"  
],  
"host" =\> "desktop",  
"@version" =\> "1",  
"@timestamp" =\> 2019-05-01T13:47:59.015Z  
}

here the message field looks like an array and i guess my filter is unable to read from it

but if i change the field name into msg In filter like below

CASE 2:

logstash.output.conf  
input {  
file {  
path =\> "/home/c.log"  
start\_position =\> "beginning"  
}  
}  
filter {

grok {

> match =\> ["message","%{GREEDYDATA:msg}"]

}  
output {  
stdout { codec =\> rubydebug }  
if "java.lang.RuntimeException" in [msg] {  
email {  
from =\> "#######@gmail.com"  
body =\> "Here is the event :%{message} \nLog file: %{path}"  
to =\> "#######@gmail.com"  
codec =\> "plain"  
contenttype =\> "text/plain; charset=UTF-8"

```
address => "smtp.gmail.com"
port => "587"
authentication => "plain"
username => "#########@gmail.com"
password => "mypassword"
use_tls => true
debug => true

```

}  
}  
}

console output :  
{  
"@timestamp" =\> 2019-05-01T13:50:31.292Z,  
"host" =\> "desktop",  
"msg" =\> "Caused by: java.lang.RuntimeException: java.io.IOException: Bad Base64 input character decimal 61 in array position 0",  
"@version" =\> "1",  
"path" =\> "/home/Desktop/a.log",  
"message" =\> "Caused by: java.lang.RuntimeException: java.io.IOException: Bad Base64 input character decimal 61 in array position 0"  
}

in this case I am able to get email notifications but i don't think its optimized solution i don't want a additional field un necessarily can i get email notifications without adding extra field.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 1, 2019, 3:11pm UTC](https://discuss.elastic.co/t/how-to-send-an-email-using-logstash-only-if-your-log-message-has-particular-string/179197/4 "2019-05-01T15:11:54Z")

</div>

> [@irobot678](#):
>
> grok {  
> match =\> ["message","%{GREEDYDATA:message}"]  
> }

Delete this. It is changing [message] from a string into an array that contains two copies of the same string. That's why your test in the output does not work.

---

<div class="post-metadata">

**Author:** ![irobot678](https://avatars.discourse-cdn.com/v4/letter/i/54ee81/32.png) [@irobot678](https://discuss.elastic.co/u/irobot678)\
**Post date:** [May 2, 2019, 7:12am UTC](https://discuss.elastic.co/t/how-to-send-an-email-using-logstash-only-if-your-log-message-has-particular-string/179197/5 "2019-05-02T07:12:28Z")

</div>

Thanks Badger it helped .

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 30, 2019, 7:12am UTC](https://discuss.elastic.co/t/how-to-send-an-email-using-logstash-only-if-your-log-message-has-particular-string/179197/6 "2019-05-30T07:12:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.