# Logstash config file alerting in telegram

**URL:** <https://discuss.elastic.co/t/logstash-config-file-alerting-in-telegram/217730>\
**Category:** Logstash\
**Tags:** elastic-stack-alerting\
**Created:** [February 4, 2020, 6:51am UTC](https://discuss.elastic.co/t/logstash-config-file-alerting-in-telegram/217730 "2020-02-04T06:51:17Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sagar\_Mandal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sagar_mandal/32/57073_2.png) [@Sagar\_Mandal](https://discuss.elastic.co/u/Sagar_Mandal)\
**Post date:** [February 4, 2020, 6:51am UTC](https://discuss.elastic.co/t/logstash-config-file-alerting-in-telegram/217730/1 "2020-02-04T06:51:17Z")

</div>

Hi Team,

So i want to send alerts in telegram through it's bot, using http output plugin.  
the purpose of this config is that whenever data is ingested in elasticsearch, i'll get a message in my telegram.

the data is being fetched from filebeat to logstash and then in elasticseacrh.

here is my configuration file,

> input {  
> beats{  
> port =\> "5044"  
> }  
> }  
> filter {  
> grok {  
> match =\> {  
> "message" =\> '%{IPORHOST:remote\_ip} - %{DATA:user\_name} [%{HTTPDATE:time}] "%{WORD:request\_action} %{DATA:request} HTTP/%{NUMBER:http\_version}" %{NUMBER:response} %{NUMBER:bytes} "%{DATA:referrer}" "%{DATA:agent}"'  
> }  
> }
> 
> date {  
> match =\> ["time", "dd/MMM/YYYY:HH:mm:ss Z"]  
> locale =\> en  
> }
> 
> geoip {  
> source =\> "remote\_ip"  
> target =\> "geoip"  
> }
> 
> useragent {  
> source =\> "agent"  
> target =\> "user\_agent"  
> }  
> }
> 
> output {  
> file{  
> path =\> "/var/log/logstash/test4.txt"  
> }  
> elasticsearch {  
> index =\> "alerttest"  
> hosts =\> ["192.168.0.102:9200","192.168.0.105:9200"]  
> }  
> http {  
> url =\> "[https://api.telegram.org/botxxxxxxx:yyyyyyyyyy/sendMessage?chat\_id](https://api.telegram.org/botxxxxxxx:yyyyyyyyyy/sendMessage?chat_id) =zzzzzzz"  
> format =\> "message"  
> content\_type =\> "application / json"  
> http\_method =\> "post"  
> message =\> '  
> {  
> "text": "Hello Bot here"  
> }  
> '  
> }  
> }

whenever i run logstash i make an indice in elasticsearch, but i don't get any alert in telegram.

however, when i manually try to send alerts using API it works, either i use curl or directly in browser.

i use curl like this and it works,

**curl -X POST "[https://api.telegram.org/botxxxxxxx:yyyyyyyyyy/sendMessage](https://api.telegram.org/botxxxxxxx:yyyyyyyyyy/sendMessage)" -d "chat\_id=zzzzzzz&text=test"**

and i manually hit the browser with this api

**[https://api.telegram.org/botxxxxxxx:yyyyyyyyyyy/sendMessage?chat\_id=zzzzzzzz&text=hey](https://api.telegram.org/botxxxxxxx:yyyyyyyyyyy/sendMessage?chat_id=zzzzzzzz&text=hey)**

both manual method works just fine.  
i get alerts with the api's

which mean bot is working just fine.

but the problem is with the config. file,

really need a help on this.

**Thanks and Regards,**  
**Sagar Mandal**

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [February 4, 2020, 8:58am UTC](https://discuss.elastic.co/t/logstash-config-file-alerting-in-telegram/217730/2 "2020-02-04T08:58:02Z")

</div>

you are sending different requests to telegram.

The manual one does not use JSON content headers and a JSON body, but the one in logstash does. Try to send the request to a local webserver first and examine the exact differences, and then ensure you are sending the same data from logstash as well by using such a local webserver.

---

<div class="post-metadata">

**Author:** ![Sagar\_Mandal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sagar_mandal/32/57073_2.png) [@Sagar\_Mandal](https://discuss.elastic.co/u/Sagar_Mandal)\
**Post date:** [February 4, 2020, 9:33am UTC](https://discuss.elastic.co/t/logstash-config-file-alerting-in-telegram/217730/3 "2020-02-04T09:33:13Z")

</div>

but till now have seen any syntax error in my code.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 3, 2020, 9:33am UTC](https://discuss.elastic.co/t/logstash-config-file-alerting-in-telegram/217730/4 "2020-03-03T09:33:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.