Hi, I have configured logstash in a way we can dynamically configure the alert keyword which will send an email when it appears in message.
My old configuration worked: I got emails when there is ERROR keyword in message
if "ERROR" in [message] {
email {
address=>"mailsrv.unix.gsm1900.org"
port=>25
from => "logstash_alert@t-mobile.com"
subject => "({SPRING_PROFILES_ACTIVE}) Logstash Alert from {APPLICATION_NAME}"
via => "smtp"
to => "{CLIENT_MAIL}"
body => "In host {HOST_IP:HOST_NOT_SET} the event line that occurred: %{message}"
}
}
New config: It is not sending any emails. I have setup the ERROR key word for this variable in /etc/default/logstash file
if "{EXCEPTION_STRING}" in [message] {
email {
address=>"mailsrv.unix.gsm1900.org"
port=>25
from => "logstash_alert@t-mobile.com"
subject => "({SPRING_PROFILES_ACTIVE}) Logstash Alert from {APPLICATION_NAME}"
via => "smtp"
to => "{CLIENT_MAIL}"
body => "In host ${HOST_IP:HOST_NOT_SET} the event line that occurred: %{message}"
}
}
Please help here. Thank you