# Logstash Email throttle not working

**URL:** https://discuss.elastic.co/t/logstash-email-throttle-not-working/75230
**Category:** Logstash
**Created:** [February 15, 2017, 5:13pm UTC](https://discuss.elastic.co/t/logstash-email-throttle-not-working/75230 "2017-02-15T17:13:46Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![amitkashyap](https://avatars.discourse-cdn.com/v4/letter/a/e274bd/32.png) [@amitkashyap](https://discuss.elastic.co/u/amitkashyap)
#### Post date: [February 15, 2017, 5:13pm UTC](https://discuss.elastic.co/t/logstash-email-throttle-not-working/75230/1 "2017-02-15T17:13:46Z")

</div>

I am able to generate mails based on events in log file but I am not able to throttle it.

below is my config file.

============================================  
input {  
beats {  
port =\> 5044  
}  
}

filter {

if [type] == "hascript\_log" {  
grok {  
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:ts}|%{IPORHOST:hostname}|%{WORD:level}|%{GREEDYDATA:txt}" }  
}

```
throttle {
	before_count => -1
	after_count => 1
	period => 60
	max_age => 120
	key => "%{message}"
	add_tag => "throttled"
}
if "throttled" in [tags] {
	drop { }
}

```

}  
}

output {  
stdout { codec =\> rubydebug  
}

```
if [type] =="hascript_log" {

	elasticsearch { 
		index => "audit-%{+YYYY.MM.dd}"
		hosts => ["localhost:9200"] 
	}

	if "throttled" not in [tags] {
		email {
		  debug => true
		  address => "mail server ip"
		  port => 25
		  body => " This is notification mailto report error in HA configuration for \n\n Detailed Description \n\n\n :\n'%{message}' \n\n\n"
		  from => "mail id"
		  subject => "Error in HA Configuration "
		  to => "Amit_Kashyap@DellTeam.com"
		}
	}
}

```

}

---

<div class="post-metadata">

### Author: ![amitkashyap](https://avatars.discourse-cdn.com/v4/letter/a/e274bd/32.png) [@amitkashyap](https://discuss.elastic.co/u/amitkashyap)
#### Post date: [February 15, 2017, 5:55pm UTC](https://discuss.elastic.co/t/logstash-email-throttle-not-working/75230/2 "2017-02-15T17:55:29Z")

</div>

> [@amitkashyap](#):
>
> below is my config file.

I also tried splitting the filter. one filter will grok the incoming request and second filter will throttle. but still getting more then 5 mails every minute.

here is the new config for filter.

filter {

if [type] == "hascript\_log" {  
grok {  
match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:ts}|%{IPORHOST:hostname}|%{WORD:level}|%{GREEDYDATA:txt}" }  
}  
}  
}

filter {  
if [type] == "hascript\_log" {  
throttle {  
before\_count =\> -1  
after\_count =\> 1  
period =\> 60  
max\_age =\> 120  
key =\> "%{message}"  
add\_tag =\> "throttled"  
}  
if "throttled" in [tags] {  
drop { }  
}  
}  
}

---

<div class="post-metadata">

### Author: ![amitkashyap](https://avatars.discourse-cdn.com/v4/letter/a/e274bd/32.png) [@amitkashyap](https://discuss.elastic.co/u/amitkashyap)
#### Post date: [February 15, 2017, 6:05pm UTC](https://discuss.elastic.co/t/logstash-email-throttle-not-working/75230/3 "2017-02-15T18:05:02Z")

</div>

any help would be really appreciated

---

<div class="post-metadata">

### Author: ![amitkashyap](https://avatars.discourse-cdn.com/v4/letter/a/e274bd/32.png) [@amitkashyap](https://discuss.elastic.co/u/amitkashyap)
#### Post date: [February 15, 2017, 7:00pm UTC](https://discuss.elastic.co/t/logstash-email-throttle-not-working/75230/4 "2017-02-15T19:00:41Z")

</div>

After changing the value of key, it seems like throttle is working now

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 15, 2017, 7:00pm UTC](https://discuss.elastic.co/t/logstash-email-throttle-not-working/75230/5 "2017-03-15T19:00:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.