Need help in configuring email alert in logstash 1.5.4

Elastic Stack Logstash
1

Hi,

I was using logstash 1.4.2 and this email alert was working fine at that time. Now my system is upgraded to logstash 1.5.4 and logstash is failing because of older settings as below:

email { 
        from => "{{Mailfrom}}" 
        match =>  [ "ERROR ALERT", "LOGLEVEL,ERROR" ]   
        subject => "%{matchName}" 
        to => "{{Rcptto}}" 
        via => "smtp" 
        htmlbody => "<h2>%{matchName}</h2><br/><br/><div   
        align='center'>%{message}</div>" 
        options => [ 
               "smtpIporHost", "{{smtpIporHost}}", 
               "port", "{{smtpPort}}", 
               "domain", "{{mailDomain}}", 
               "userName", "{{Mailfrom}}", 
               "password", "{{MailFromPassword}}", 
               "authenticationType", "plain", 
               "starttls", "true" 
       ]
}

Now I am getting error as "You are using a deprecated config setting \"match\" set in email. Deprecated settings will continue to work, but are scheduled for removal from logstash in the future. If you have any questions about this, please visit the #logstash channel on freenode irc."

Can anyone help me here, as how should i configure it according to ERROR condition in 1.5.4?

Thanks in advance!

2

I don't know what match => [ "ERROR ALERT", "LOGLEVEL,ERROR" ] actually means, but you'll want to use a conditional, perhaps something like this:

if [ERROR ALERT] == "LOGLEVEL,ERROR" {
  email {
    ...
  }
}
3

Figured out, how to handle it. I applied it in following way and it worked.

if "Erro" in [severity] {
email {
        from => "someone@somedomain.com"
        subject => "Error Alert"
        to => "someone@somedomain.com"
        via => "smtp"
        htmlbody => "<h2>Error Alert1</h2><br/><br/><div
        align='center'>%{message}</div>"
        options => [
               "smtpIporHost", "smtp.office365.com",
               "port", "587",
               "domain", "smtp.office365.com",
               "userName", "someone@somedomain.com",
               "password", "somepasswd",
               "authenticationType", "login",
               "starttls", "true"
       ]
}
}

Hope this can be useful to anyone in future.