Logging To Slack with escaped JSON strings

Elastic Stack Logstash
1

Hey,

i'm receiving loggin events as json via UDP in Logstash and want to send them to Slack if certain conditions are met. Problem is that the Slack Plugin converts the fields to json strings which fails if there are some bad characters in it (like " or newline).

My config looks like this:
input {
udp {
codec => "json"
port => 5005
}
}
output {
if [@l] == "Error" and [SourceContext] =~ /^Server/ {
slack {
codec => "json"
url => "..."
format => "An error occurred:"
attachments => [
{
fallback => "An Error was logged with message: %{@m}"
color => "danger"
fields => [
{
title => "Message"
value => "%{@m}"
},
{
title => "Instance"
value => "%{MachineName}"
short => true
}
]
footer => "Logstash"
footer_icon => "https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcR3P3mb2iIpvgUIfuF26hE15gzHbXFsrPdCxbprQ5EFhE9ORMTlyQ"
}
]
}
}
}

Do i have to manually escape the fields i'm using within the body for the slack plugin? Or is there any other "automatic" way?

Thanks!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.