# Logstash metric filter - help

**URL:** <https://discuss.elastic.co/t/logstash-metric-filter-help/80313>\
**Category:** Logstash\
**Created:** [March 28, 2017, 2:50pm UTC](https://discuss.elastic.co/t/logstash-metric-filter-help/80313 "2017-03-28T14:50:26Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![August\_rush](https://avatars.discourse-cdn.com/v4/letter/a/13edae/32.png) [@August\_rush](https://discuss.elastic.co/u/August_rush)\
**Post date:** [March 28, 2017, 2:50pm UTC](https://discuss.elastic.co/t/logstash-metric-filter-help/80313/1 "2017-03-28T14:50:26Z")

</div>

The example log file contains a list of logs , i am trying to apply a metric filter to check the count of log-level==ERROR for every 5 s and if the count is greater than 1 then it should trigger an email, i am not sure , what is wrong here , but it's not working - using logstash 2.2.4

```
      input {
              file {
                path => "/var/log/logstash/example"
                start_position => beginning
              }
            }

    filter {
     grok{
       match => { "message" => "\[%{TIMESTAMP_ISO8601:timestamp}\]\[%{LOGLEVEL:log-level}\s*\]" }
     }
     if [log-level] == "ERROR" {
       metrics {
           meter => ["log-level"]
           flush_interval => 5
           clear_interval => 5
          }
       }
    }
    output {
    if [log-level] == "ERROR" {
      if [log-level][count] < 1 {
        email {
            port => 25
            address => "mail.abc.com"
            authentication => "login"
            use_tls => true
            from => "alerts@logstash.com"
            subject => "logstash alert"
            to => "***@abc.com"
            via => "smtp"
            body => "here is the event line %{message}"
            debug => true
          }
        }
      }
    }
```

---

<div class="post-metadata">

**Author:** ![prodrg](https://avatars.discourse-cdn.com/v4/letter/p/3bc359/32.png) [@prodrg](https://discuss.elastic.co/u/prodrg)\
**Post date:** [March 28, 2017, 3:06pm UTC](https://discuss.elastic.co/t/logstash-metric-filter-help/80313/2 "2017-03-28T15:06:16Z")

</div>

Can you please send the logs from Logstash? It's to check what kind of errors it is throwing

---

<div class="post-metadata">

**Author:** ![August\_rush](https://avatars.discourse-cdn.com/v4/letter/a/13edae/32.png) [@August\_rush](https://discuss.elastic.co/u/August_rush)\
**Post date:** [March 28, 2017, 3:09pm UTC](https://discuss.elastic.co/t/logstash-metric-filter-help/80313/3 "2017-03-28T15:09:16Z")

</div>

> [@prodrg](#):
>
> m Logstash? It's to check what kin

There are no errors in the logstash.log file  
tail -n 4 logstash.log

> ```
> {:timestamp=>"2017-03-28T10:33:11.727000-0400", :message=>"Adding pattern", "RUBY_LOGLEVEL"=>"(?:DEBUG|FATAL|ERROR|WARN|INFO)", :level=>:info}
> {:timestamp=>"2017-03-28T10:33:11.727000-0400", :message=>"Adding pattern", "RUBY_LOGGER"=>"[DFEWI], \\[%{TIMESTAMP_ISO8601:timestamp} #%{POSINT:pid}\\] *%{RUBY_LOGLEVEL:loglevel} -- +%{DATA:progname}: %{GREEDYDATA:message}", :level=>:info}
> {:timestamp=>"2017-03-28T10:33:33.451000-0400", :message=>"Starting pipeline", :id=>"base", :pipeline_workers=>2, :batch_size=>125, :batch_delay=>5, :max_inflight=>250, :level=>:info}
> {:timestamp=>"2017-03-28T10:33:33.455000-0400", :message=>"Pipeline started", :level=>:info}
> 
> ```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 25, 2017, 3:09pm UTC](https://discuss.elastic.co/t/logstash-metric-filter-help/80313/4 "2017-04-25T15:09:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.