Logstash email alerts dynamically from multiple log files

Elastic Stack Logstash
1

I have the logstash config file in which i have written the mail alert for particular text present in the message then automatically send an email with the message. Please find the configuration file (logstash.conf).

input {
file {
path => [ "\IP Address\logs/LMS.log.*_bak" ]
start_position => "beginning"
}
}

output {
elasticsearch {
bind_host => "127.0.0.1"
port => "9200"
protocol => http
}
if "ERROR" in [message] {
email {
from => "logstash.alert@nowhere.com"
subject => "logstash alert"
to => "test.lms@gmail.com"
via => "smtp"
body => "Here is the event line that occured: %{message}"
}
}
}
Here i am not not getting any email from that configuration.So anyone please find that configuration give the solution for me thanks...

2

Is there anything interesting in the Logstash logs? What if you turn up the logging with --verbose or -debug? Are you getting data into Elasticsearch? Is new data being added to the log files?

Break down the problem and isolate the factors. What if you skip the conditional around the email output and the elasticsearch output and use a stdin input to feed messages one by one. Does it send any email messages then? If yes, reintroduce things until you get to a stage where it doesn't work again.

3

HI Magnusbaeck,

Thanks for replying me, am waiting from last 20 min for your valuable response.

Yes exactly i tried with --debug option, logs are loaded from logstash and for email giving this response.

Pasted image1357×111 31.1 KB

But, am not getting any emails.

4

Is new data being added to the files you're monitoring? Logstash will only read old logfiles from the beginning under certain circumstances.

Next time, please copy/paste from logs. Don't use screenshots.

5

Actually i added some logs to the location of old logs present. Logstash automatically updated with the new logs but mails are not coming. Elastic search also automatically update the new logs into their storage.

6

Okay. Then proceed with isolating the issue as I described earlier.

10

Wait, have you verified that your SMTP server hasn't received the messages? The problem could just as well be that Gmail won't accept the messages. Your SMTP server's log will contain clues.

11

Yes @magnusbaeck, I have the error like this. Sorry for uploading the image,but am unable to tell the problem with you...

Pasted image1355×263 64.7 KB

12

By default Logstash tries to send SMTP messages to localhost:25. It seems you don't have an SMTP server listening on that port. The smtp output documentation isn't too good (see bug #24) so see http://stackoverflow.com/questions/25481252/notifying-log-errors-via-email-using-logstash for a complete example. That said, I think you should set up an SMTP server on the Logstash machine to make sure thta Logstash can always load off messages. Otherwise an SMTP server outage would halt the Logstash pipeline.

13

Thank you very much @magnusbaeck. You are so helpful to me. I seen from last 2 days about your posts and finally i got the solution with your help. Thank you man......