Hi
[2017-01-14 10:48:06,848][WARN ][index.search.slowlog.query] [yaswanth] [bank][0] took[27.8ms], took_millis[27], types[], stats[], search_type[QUERY_THEN_FETCH], total_shards[5], source[], extra_source[],
[2017-01-14 10:48:06,851][WARN ][index.search.slowlog.query] [yaswanth] [bank][3] took[12.7ms], took_millis[33], types[], stats[], search_type[QUERY_THEN_FETCH], total_shards[5], source[], extra_source[],
Using below config i am sending the logs to my email using logstash:
input {
file {
path => "C:\Users\571952\Desktop\pica.txt"
start_position => "beginning"
}
}
filter {
grok {
match => [ "message",
"\[%{TIMESTAMP_ISO8601:TIMESTAMP}\]\[%{LOGLEVEL:LEVEL}%{SPACE}\]\[%{DATA:QUERY}\]%{SPACE}\[%{DATA:QUE
RY1}\]%{SPACE}\[%{DATA:INDEX-NAME}\]\[%{DATA:SHARD}\]%{SPACE}took\[%{DATA:TOOK}\],%{SPACE}
took_millis\[%{DATA:TOOKM}\], types\[%{DATA:types}\], stats\[%{DATA:stats}\], search_type
\[%{DATA:search_type}\], total_shards\[%{NUMBER:total_shards}\], source\[%{DATA:source_query}\],
extra_source\[%{DATA:extra_source}\],"]
}
mutate {
convert => { "TOOKM" => "integer" }
}
if [TOOKM] > 15 {
} else {
drop { }
}
}
output {
email {
to => "zyx@gmail.com"
body => "Here is the event line that occured: %{message}"
address => "smtp.gmail.com"
port => 587
username => "xyz@gmail.com"
password => "mypass"
}
stdout { codec => rubydebug }
}
I am getting error like this
←[31mSomething happen while delivering an email {:exception=>#<Errno::ECONNREFUS
ED: Connection refused - Connection refused>, :level=>:error}←[0m
←[31mSomething happen while delivering an email {:exception=>#<Errno::ECONNREFUS
ED: Connection refused - Connection refused>, :level=>:error}←[0m
←[31mSomething happen while delivering an email {:exception=>#<Errno::ECONNREFUS
ED: Connection refused - Connection refused>, :level=>:error}←[0m
FYI - I am running the logstash in windows .
Do i need to install any SMTP server in my windows machine to send the mail or logstash alone will do that for me as per the above configuration?
Thanks