Is the email plugin defunct in LS 2.1?

Elastic Stack Logstash
1

How can I enable e-mail alerting in LS 2.1?

This:

  # Alerting
    if [log_message] == "POSSIBLE BREAK-IN ATTEMPT!" {
  email {
  body => "Triggered in: %{message}"
  subject => "This is a Logstash alert for POSSIBLE BREAK-IN ATTEMPTS!"
  from => "logstash.alert@example.com"
  to => "admin@example.com"
  via => "sendmail"
 }
}

Yields the following:

[root@logs:/etc/logstash/conf.d] #/opt/logstash/bin/logstash --configtest --config 20-filters.conf
The error reported is:
  Couldn't find any filter plugin named 'email'. Are you sure this is correct? Trying to load the email filter      plugin resulted in this error: no such file to load -- logstash/filters/email
2

The email plugin is an output plugin and has to be in the 'output' block of the configuration. Based on the error message it looks like you are trying to use it from the 'filter' block.

3

Ah, ok. Thanks for the clarification.

output {
  elasticsearch {
hosts => [“10.10.10.25”, “10.10.10.26”, “10.10.10.27”]
index => "logstash-%{+YYYY.MM.dd}"
user => "ls_user"
  password => “secret”
  }
# Alerting
if [log_message] == "POSSIBLE BREAK-IN ATTEMPT!" {
   email {
  body => "Triggered in: %{message}"
  subject => "This is a Logstash alert for POSSIBLE BREAK-IN ATTEMPTS!"
  from => "logstash.alert@example.com"
  to => "admin@example.com"
  via => "sendmail"
   }
}
}

Gives:

[root@logs:/etc/logstash/conf.d] #/opt/logstash/bin/logstash --configtest --config 30-logstash-output.conf
Configuration OK

Thanks!!

4

I moved the discussion in Logstash group.