Is the email plugin defunct in LS 2.1?


(Tim Dunphy) #1

How can I enable e-mail alerting in LS 2.1?

This:

  # Alerting
    if [log_message] == "POSSIBLE BREAK-IN ATTEMPT!" {
  email {
  body => "Triggered in: %{message}"
  subject => "This is a Logstash alert for POSSIBLE BREAK-IN ATTEMPTS!"
  from => "logstash.alert@example.com"
  to => "admin@example.com"
  via => "sendmail"
 }
}

Yields the following:

[root@logs:/etc/logstash/conf.d] #/opt/logstash/bin/logstash --configtest --config 20-filters.conf
The error reported is:
  Couldn't find any filter plugin named 'email'. Are you sure this is correct? Trying to load the email filter      plugin resulted in this error: no such file to load -- logstash/filters/email

(Christian Dahlqvist) #2

The email plugin is an output plugin and has to be in the 'output' block of the configuration. Based on the error message it looks like you are trying to use it from the 'filter' block.


(Tim Dunphy) #3

Ah, ok. Thanks for the clarification.

output {
  elasticsearch {
hosts => [“10.10.10.25”, “10.10.10.26”, “10.10.10.27”]
index => "logstash-%{+YYYY.MM.dd}"
user => "ls_user"
  password => “secret”
  }
# Alerting
if [log_message] == "POSSIBLE BREAK-IN ATTEMPT!" {
   email {
  body => "Triggered in: %{message}"
  subject => "This is a Logstash alert for POSSIBLE BREAK-IN ATTEMPTS!"
  from => "logstash.alert@example.com"
  to => "admin@example.com"
  via => "sendmail"
   }
}
}

Gives:

[root@logs:/etc/logstash/conf.d] #/opt/logstash/bin/logstash --configtest --config 30-logstash-output.conf
Configuration OK

Thanks!!


(David Pilato) #4

I moved the discussion in Logstash group.


(system) #5