Logstash smtp configuration

Elastic Stack Logstash
1

Hi

I want to config logstash output to email by smtp,but it always goes wrong,this is my configuration:

email {
  to => "xxx@xxx.com.cn"
  codec => "plain"
  contenttype => "text/html; charset=UTF-8"
  options => {
    smtpIporHost => "smtp.xxx.com.cn"
    port => 465
    userName => "xxx@xxx.com.cn"
    password => "xxx"
    starttls => true
  }
}

Error message:

Net::SMTPServerBusy: 440 mail from account doesn't conform with authentication (Auth Account:zhibin.wang@eproe.com.cn|Mail Account:logstash.alert@nowhere.com)

  check_response at /opt/logstash/vendor/jruby/lib/ruby/1.9/net/smtp.rb:949
           getok at /opt/logstash/vendor/jruby/lib/ruby/1.9/net/smtp.rb:918
        mailfrom at /opt/logstash/vendor/jruby/lib/ruby/1.9/net/smtp.rb:833
    send_message at /opt/logstash/vendor/jruby/lib/ruby/1.9/net/smtp.rb:660
        deliver! at /opt/logstash/vendor/bundle/jruby/1.9/gems/mail-2.6.3/lib/mail/network/delivery_methods/smtp.rb:113
           start at /opt/logstash/vendor/jruby/lib/ruby/1.9/net/smtp.rb:521
        deliver! at /opt/logstash/vendor/bundle/jruby/1.9/gems/mail-2.6.3/lib/mail/network/delivery_methods/smtp.rb:112
        deliver! at /opt/logstash/vendor/bundle/jruby/1.9/gems/mail-2.6.3/lib/mail/message.rb:252
         receive at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-email-1.0.0/lib/logstash/outputs/email.rb:250
          handle at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.4-java/lib/logstash/outputs/base.rb:88
     output_func at (eval):52
    outputworker at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.4-java/lib/logstash/pipeline.rb:244
   start_outputs at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.4-java/lib/logstash/pipeline.rb:166

if anyone could help me to resolve that issues?

2

The error message,

440 mail from account doesn't conform with authentication (Auth Account:zhibin.wang@eproe.com.cn|Mail Account:logstash.alert@nowhere.com)

indicates that the SMTP relay wants the SMTP envelope sender address to match the username used for authentication. So, use the plugin's from parameter to change the sender address to zhibin.wang@eproe.com.cn.

Keep in mind that if Logstash ever has problems sending email that'll halt the whole pipeline (which you perhaps already have discovered). I suggest that you let Logstash offload messages to localhost or some internal SMTP relay so that it doesn't interfere with Logstash's logging pipeline.

(Port 465 is normally SMTP over SSL while the starttls is for STARTTLS which is usually port 25 or 587. I'm somewhat surprised this appears to work as well as it does.)

3

thanks very much! logstash has successed to send mail by add from parameter.

i knew this will cause the whole events will be sended by email,i‘m just verifying the function of email alert and just a few messages,later i will build my alarm logic to check which pipeline should send out from email.

thanks!