elk 监控报警

使用logstash output 模块 mail{}.判断message关键字.

output {

    if "ERROR" in [message] {
        email {
            to => "xxxx@xxxx"
            from => "xxxx@xxxx"
            address => "smtp.xxxx"
            username => "xxxx@xxxx"
            password => "xxxx"
            subject => "bxx"
            body => "bxx logs"
            htmlbody => "%{message}"
        }
    }
    if "hehehe" in [message] {
        email {
            to => "[email protected]"
            from => "xxxx"
            address => "smtp.xxxx"
            username => "xxxx@xxx"
            password => "xxxx"
            subject => "bxxx"
            body => "bxxxx hehehehe"
            htmlbody => "%{message}"
        }

    }

    elasticsearch {
        hosts => ["192.168.12.54:9200"]
        index => "%{[fields][type]}111-%{+YYYY.MM.dd}"
user => elastic
password => xxxx
    } 
}