Sending email on some event

Elastic Stack Logstash
1

Hii I am using logstash . I want to send an email on receiving a error log . This is my config -

if [loglevel] == "local.ERROR" or [loglevel] == "staging.ERROR" {
email {
from => "abhi15@gmail.com"
to => "prithviabhi@gmail.com"
body => "Dude your product has received a ERROR LOG !!!!!"
}
elasticsearch { hosts => ["localhost:9200"]
index => "error_logs-2016.01.08"
}
}
but when a log gets pushed email could not be sent and this is what I get on the screen-

Something happen while delivering an email {:exception=>#<Errno::ECONNREFUSED: Connection refused - Connection refused>, :level=>:error}

I think i need to change some setting . What is the problem ??? Do i need to open a port to allow access or something ???

2

This assumes you have an SMTP service running on localhost, do you?

3

@warkolm doing netstat is not providing any result at port 25 to me . Further doing "telnet www.gmail.com " does nothing . I want to send email to a gmail user(though can be any).So what more I need to specify in my config?

4

Further doing "telnet www.gmail.com " does nothing .

www.gmail.com doesn't respond on the telnet port. It probably won't respond on any port except HTTP and HTTPS, actually.

I want to send email to a gmail user(though can be any).So what more I need to specify in my config?

I think you should run an SMTP server on the same machine and configure Logstash to use it, but you could use another one on your local network instead. If none is available, use an outside relay. If Logstash can't send email it'll pause the log processing pipeline and you don't want that, which is why it's a good idea to make it as easy for Logstash to offload messages.

Once you've decided which server to use, the email output's documentation lists a few options that you'll need to adjust.

5

@magnusbaeck so let just say i have my SMTP server running on the same machine as logstash . Will then I be able to email to a gmail user ??? Also let me know how can I test whether I already have SMTP server on my system or not ?

6

so let just say i have my SMTP server running on the same machine as logstash . Will then I be able to email to a gmail user ???

Yes.

Also let me know how can I test whether I already have SMTP server on my system or not ?

If something's answering on TCP port 25 that's a good sign.

7

@magnusbaeck as i mentioned above doing -
netstat -tulpn | grep ":25" does not give any output . So how to check otherwise ??

8

Well, that indicates that you don't have an SMTP server running. Unless you have another one on your local network I suggest you install one and configure it. I prefer Postfix. Over and out.

9

@magnusbaeck copy that ................

10

@magnusbaeck i have set up postfix smtp server and i m able to send emails by it too but when used in my logstash config as below i don't receive any mail on my gmail-

email {
to => "prithviabhi00007@gmailcom"
body => "ALERT!!!!!!!!"
}

11

There's a period missing from that the email address.

Anyway, for Postfix problems do read the Postfix logs for clues and reach out to Postfix experts for help.