# Sending e-mail - condition expression

**URL:** <https://discuss.elastic.co/t/sending-e-mail-condition-expression/46840>\
**Category:** Beats\
**Created:** [April 8, 2016, 6:53pm UTC](https://discuss.elastic.co/t/sending-e-mail-condition-expression/46840 "2016-04-08T18:53:42Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![rafaellamuniz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rafaellamuniz/32/8885_2.png) [@rafaellamuniz](https://discuss.elastic.co/u/rafaellamuniz)\
**Post date:** [April 8, 2016, 6:53pm UTC](https://discuss.elastic.co/t/sending-e-mail-condition-expression/46840/1 "2016-04-08T18:53:42Z")

</div>

Hello,

I'm using the Topbeat to monitor the server resources. I need to configure the Logstash output to send e-mail when some file system is over than 70%.

But I'm not sure about the sintax on the condition expression:

if [fs.used\_p] \>= "70" {  
email {  
....

Anybody know if it is correct to put the varialbe "fs.used\_p" with dot or I should put something like that: %{[fs][used\_p]}?

And is it correct to use the condition with number? Because the variable fs.used\_p on topbeat has your value with % (Eg. 30%). So I don't know if the expression \>= "70" is gonna work.

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\
**Post date:** [April 8, 2016, 9:22pm UTC](https://discuss.elastic.co/t/sending-e-mail-condition-expression/46840/2 "2016-04-08T21:22:15Z")

</div>

Topbeat uses floating points between 0 and 1 to represent percentages. So the condition should be some thing like `>= 0.7`, but I'm not sure about the exact Logstash syntax.

---

<div class="post-metadata">

**Author:** ![rafaellamuniz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rafaellamuniz/32/8885_2.png) [@rafaellamuniz](https://discuss.elastic.co/u/rafaellamuniz)\
**Post date:** [April 11, 2016, 2:54pm UTC](https://discuss.elastic.co/t/sending-e-mail-condition-expression/46840/3 "2016-04-11T14:54:09Z")

</div>

Thank you very much for your answer, that helps.

Now, I need to know how to put the variable with dot (fs.used\_p) on condition.

I've tried many ways but is not working ☹

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [April 11, 2016, 4:13pm UTC](https://discuss.elastic.co/t/sending-e-mail-condition-expression/46840/4 "2016-04-11T16:13:26Z")

</div>

@rafaellamuniz if I remember correctly you have to use `[fs][used_p]`

try this:

```auto
outputs {
  if [fs][used_p] >= 0.7 {
     stdout { codec => rubydebug }
  }
}

```

---

<div class="post-metadata">

**Author:** ![rafaellamuniz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rafaellamuniz/32/8885_2.png) [@rafaellamuniz](https://discuss.elastic.co/u/rafaellamuniz)\
**Post date:** [April 11, 2016, 5:25pm UTC](https://discuss.elastic.co/t/sending-e-mail-condition-expression/46840/5 "2016-04-11T17:25:27Z")

</div>

I've tried this sintax, unfortunately it isn't work:

```auto
/opt/logstash/bin# ./logstash -f ../conf.d.topbeat/ --configtest
An unexpected error occurred! {:error=>#<NoMethodError: undefined method `config_valid?' for LogStash::Pipeline:Class>, :class=>"NoMethodError", :backtrace=>["/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.0-java/lib/logstash/agent.rb:169:in `execute'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.0-java/lib/logstash/runner.rb:94:in `run'", "org/jruby/RubyProc.java:281:in `call'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.3.0-java/lib/logstash/runner.rb:99:in `run'", "org/jruby/RubyProc.java:281:in `call'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.22/lib/stud/task.rb:24:in `initialize'"], :level=>:warn}

```

This is my output file:

```auto
output {
        elasticsearch {
                hosts => ["..."]
                index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
                document_type => "%{[@metadata][type]}"
       }

if [fs][used_p] >= "0.7" {
        email {
                address => "..."
                port => 25
                authentication => "plain"
                from => "..."
               subject => "%{[fs][used_p]} - %{[beat][hostname]} %{[fs][mount_point]}"
               to => "..."
               via => "smtp"
               htmlbody => "
               ...
               "
    }
}
}

```

---

<div class="post-metadata">

**Author:** ![rafaellamuniz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rafaellamuniz/32/8885_2.png) [@rafaellamuniz](https://discuss.elastic.co/u/rafaellamuniz)\
**Post date:** [April 12, 2016, 12:14pm UTC](https://discuss.elastic.co/t/sending-e-mail-condition-expression/46840/6 "2016-04-12T12:14:24Z")

</div>

Any idea?

---

<div class="post-metadata">

**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\
**Post date:** [April 12, 2016, 12:33pm UTC](https://discuss.elastic.co/t/sending-e-mail-condition-expression/46840/7 "2016-04-12T12:33:55Z")

</div>

At this point, you might get better answers for this in the Logstash section of the forums. Configuration looks good to me, the error doesn't seem to be related to the file, looks more like a bad logstash installation.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:53pm UTC](https://discuss.elastic.co/t/sending-e-mail-condition-expression/46840/8 "2017-07-05T21:53:26Z")

</div>