Sending e-mail - condition expression

Elastic Stack Beats
1

Hello,

I'm using the Topbeat to monitor the server resources. I need to configure the Logstash output to send e-mail when some file system is over than 70%.

But I'm not sure about the sintax on the condition expression:

if [fs.used_p] >= "70" {
email {
....

Anybody know if it is correct to put the varialbe "fs.used_p" with dot or I should put something like that: %{[fs][used_p]}?

And is it correct to use the condition with number? Because the variable fs.used_p on topbeat has your value with % (Eg. 30%). So I don't know if the expression >= "70" is gonna work.

Thanks in advance.

2

Topbeat uses floating points between 0 and 1 to represent percentages. So the condition should be some thing like >= 0.7, but I'm not sure about the exact Logstash syntax.

3

Thank you very much for your answer, that helps.

Now, I need to know how to put the variable with dot (fs.used_p) on condition.

I've tried many ways but is not working :frowning:

4

@rafaellamuniz if I remember correctly you have to use [fs][used_p]

try this:

outputs {
  if [fs][used_p] >= 0.7 {
     stdout { codec => rubydebug }
  }
}
5

I've tried this sintax, unfortunately it isn't work:

/opt/logstash/bin# ./logstash -f ../conf.d.topbeat/ --configtest
An unexpected error occurred! {:error=>#<NoMethodError: undefined method `config_valid?' for LogStash::Pipeline:Class>, :class=>"NoMethodError", :backtrace=>["/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.0-java/lib/logstash/agent.rb:169:in `execute'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.0-java/lib/logstash/runner.rb:94:in `run'", "org/jruby/RubyProc.java:281:in `call'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.0-java/lib/logstash/runner.rb:99:in `run'", "org/jruby/RubyProc.java:281:in `call'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.22/lib/stud/task.rb:24:in `initialize'"], :level=>:warn}

This is my output file:

output {
        elasticsearch {
                hosts => ["..."]
                index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
                document_type => "%{[@metadata][type]}"
       }

if [fs][used_p] >= "0.7" {
        email {
                address => "..."
                port => 25
                authentication => "plain"
                from => "..."
               subject => "%{[fs][used_p]} - %{[beat][hostname]} %{[fs][mount_point]}"
               to => "..."
               via => "smtp"
               htmlbody => "
               ...
               "
    }
}
}
6

Any idea?

7

At this point, you might get better answers for this in the Logstash section of the forums. Configuration looks good to me, the error doesn't seem to be related to the file, looks more like a bad logstash installation.