Question

我以一种可以动态配置alert关键字的方式配置了logstash，该关键字将在出现在消息中时发送电子邮件。当我使用变量作为电子邮件触发关键字时，Logstash无法发送电子邮件。

我的旧配置有效：消息中有ERROR关键字时，我收到了电子邮件

 if "ERROR" in [message] {
email {
  address=>"mailsrv.unix.gsm1900.org"
  port=>25
  from => "logstash_alert@t-mobile.com"
  subject => "(${SPRING_PROFILES_ACTIVE}) Logstash Alert from ${APPLICATION_NAME}"
  via => "smtp"
  to => "${CLIENT_MAIL}"
  body => "In host ${HOST_IP:HOST_NOT_SET} the event line that occurred: %{message}"
}

新配置：它不发送任何电子邮件。我在/ etc / default / logstash文件中为此变量设置了ERROR关键字

 if "${EXCEPTION_STRING}" in [message] {
email {
  address=>"mailsrv.unix.gsm1900.org"
  port=>25
  from => "logstash_alert@t-mobile.com"
  subject => "(${SPRING_PROFILES_ACTIVE}) Logstash Alert from ${APPLICATION_NAME}"
  via => "smtp"
  to => "${CLIENT_MAIL}"
  body => "In host ${HOST_IP:HOST_NOT_SET} the event line that occurred: %{message}"
}

请在这里帮助。谢谢

Answer 1

将您的返回机器跳转到2016，以查看条件条件不支持变量。该文章提供了将变量设置为元数据的变通办法，然后可以在条件中使用该变量：

mutate {
  add_field => { "[@metadata][EXCEPTION_STRING]" => "${EXCEPTION_STRING}" }
}

if [@metadata][EXCEPTION_STRING] in [message] {
  ...
}

当我使用变量作为电子邮件触发关键字时，Logstash无法发送电子邮件

1 个答案: