# Trigger email event(output) on file input which having csv filter **URL:** \ **Category:** Logstash\ **Created:** [April 4, 2018, 5:20am UTC](https://discuss.elastic.co/t/trigger-email-event-output-on-file-input-which-having-csv-filter/126673 "2018-04-04T05:20:49Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![adg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adg/32/45618_2.png) [@adg](https://discuss.elastic.co/u/adg)\ **Post date:** [April 4, 2018, 5:20am UTC](https://discuss.elastic.co/t/trigger-email-event-output-on-file-input-which-having-csv-filter/126673/1 "2018-04-04T05:20:50Z")
while using logstash i stuck for sending email on event when i found list of specific expression in input file which is filter by csv plugin ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 4, 2018, 6:00am UTC](https://discuss.elastic.co/t/trigger-email-event-output-on-file-input-which-having-csv-filter/126673/2 "2018-04-04T06:00:12Z")
Wrap your email output in a conditional that looks at the input event to decide what to do. [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html) ---
**Author:** ![adg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adg/32/45618_2.png) [@adg](https://discuss.elastic.co/u/adg)\ **Post date:** [April 4, 2018, 9:38am UTC](https://discuss.elastic.co/t/trigger-email-event-output-on-file-input-which-having-csv-filter/126673/3 "2018-04-04T09:38:29Z")
i read input from file where logs is created like this > 2018-04-04T09:15:37+0000,vagrant-ubuntu-trusty-64,vagrant,1000,1459,/dev/pts/0,"/home/vagrant","/bin/su","su USERNAME" > 2018-04-04T09:15:39+0000,vagrant-ubuntu-trusty-64,USERNAME,1003,1459,/dev/pts/0,"/home/vagrant","/usr/bin/groups","groups" > 2018-04-04T09:15:39+0000,vagrant-ubuntu-trusty-64,USERNAME,1003,1459,/dev/pts/0,"/home/vagrant","/usr/bin/lesspipe","lesspipe" > 2018-04-04T09:15:39+0000,vagrant-ubuntu-trusty-64,USERNAME,1003,1459,/dev/pts/0,"/home/vagrant","/usr/bin/basename","basename /usr/bin/lesspipe" > 2018-04-04T09:15:39+0000,vagrant-ubuntu-trusty-64,USERNAME,1003,1459,/dev/pts/0,"/home/vagrant","/usr/bin/dirname","dirname /usr/bin/lesspipe" > 2018-04-04T09:15:39+0000,vagrant-ubuntu-trusty-64,USERNAME,1003,1459,/dev/pts/0,"/home/vagrant","/usr/bin/dircolors","dircolors -b" > 2018-04-04T09:16:01+0000,vagrant-ubuntu-trusty-64,USERNAME,1003,1459,/dev/pts/0,"/home/USERNAME","/bin/rm","rm USERNAME\_f" > 2018-04-04T09:16:05+0000,vagrant-ubuntu-trusty-64,USERNAME,1003,1459,/dev/pts/0,"/home/USERNAME","/bin/rm","rm USERNAME\_file" i use csv filter > csv{ > separator =\> "," > columns =\> ["DateTime" ,"hostname" ,"username" ,"uid","sid","tty","cwd","filename","cmdline"] on output there is one plug-in go for elasticsearch and other plugin of email > if "/bin/rm" in [columns] { > email{ > address =\> "[smtp.gmail.com](http://smtp.gmail.com)" > domain =\> "[smtp.gmail.com](http://smtp.gmail.com)" > port =\> 25 > username =\> "" > password =\> "" > from =\> "" > subject =\> "Error status" > to =\> "" > body =\> "Here is the event line that occured: %{@message}" > htmlbody =\> " > } > } but mail is not trigger might be condition is wrongly stated of mail setting is wrong but i configure smtp mail in this linux machine and able to sent mail via terminal but not via logstash output ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 4, 2018, 9:58am UTC](https://discuss.elastic.co/t/trigger-email-event-output-on-file-input-which-having-csv-filter/126673/4 "2018-04-04T09:58:13Z")
Have you looked in the Logstash log for clues? If your ISP allows you to connect to [smtp.gmail.com:25](http://smtp.gmail.com:25) you'll only be able to send email to Gmail-hosted addresses. If you want to use Gmail as an SMTP relay you need to authenticate and use SSL or TLS. I suggest you configure a local MTA and have Logstash connect to it instead. Then you can configure SMTP in a single play and have any number of local daemons send email. ---
**Author:** ![adg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adg/32/45618_2.png) [@adg](https://discuss.elastic.co/u/adg)\ **Post date:** [April 4, 2018, 10:26am UTC](https://discuss.elastic.co/t/trigger-email-event-output-on-file-input-which-having-csv-filter/126673/5 "2018-04-04T10:26:02Z")
> [@adg](#): > > if "/bin/rm" in [columns] { is my this condition is correct the columns i want to check is filename as mention in csv filter AND i saw logstash-plain.log file in /opt/logstash/logs/logstash-plain.log here is logs coming repetitively > [2018-04-04T09:03:09,644][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"snoopy", :\_type=\>"doc", :\_routing=\>nil}, #LogStash::Event:0x202f72e0], :response=\>{"index"=\>{"\_index"=\>"firstindex", "\_type"=\>"doc", "_id"=\>"ojLlj2IBGlko91sbQqSv", "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse [DateTime]", "caused\_by"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"Invalid format: " s/^IF\_OFFLOAD_//; s/=.\*//; s...""}}}}} yes it also show this too [2018-04-04T10:33:14,655][ERROR][logstash.outputs.email] Something happen while delivering an email {:exception=\>#\ **Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 4, 2018, 11:19am UTC](https://discuss.elastic.co/t/trigger-email-event-output-on-file-input-which-having-csv-filter/126673/6 "2018-04-04T11:19:33Z") > is my this condition is correct No, since you don't have a `columns` field. It looks like "/bin/rm" ends up in the `filename` field so you can do this instead: ``` if [filename] == "/bin/rm" { ``` The ES error in the log is because you for some reason have ended up with garbage in the `DateTime` field. I don't know what "s/^IF\_OFFLOAD//; s/=.\*/" comes from. The email output error indicates that you need to enable TLS in the plugin. ---
**Author:** ![adg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adg/32/45618_2.png) [@adg](https://discuss.elastic.co/u/adg)\ **Post date:** [April 6, 2018, 12:55pm UTC](https://discuss.elastic.co/t/trigger-email-event-output-on-file-input-which-having-csv-filter/126673/7 "2018-04-06T12:55:54Z")
thanks i corrected my condition and the that DateTime issue is might be due to some mutate filter option put it Thanks for help ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 4, 2018, 12:56pm UTC](https://discuss.elastic.co/t/trigger-email-event-output-on-file-input-which-having-csv-filter/126673/8 "2018-05-04T12:56:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.