在 logstash 1.5.4 中配置电子邮件警报时需要帮助

Question

我使用的是 logstash 1.4.2，当时这个电子邮件警报运行良好。现在我的系统升级到 logstash 1.5.4 并且由于以下旧设置而导致 logstash 失败：

email { 
        from => "{{Mailfrom}}" 
        match =>  [ "ERROR ALERT", "LOGLEVEL,ERROR" ]   
        subject => "%{matchName}" 
        to => "{{Rcptto}}" 
        via => "smtp" 
        htmlbody => "<h2>%{matchName}</h2><br/><br/><div   
        align='center'>%{message}</div>" 
        options => [ 
               "smtpIporHost", "{{smtpIporHost}}", 
               "port", "{{smtpPort}}", 
               "domain", "{{mailDomain}}", 
               "userName", "{{Mailfrom}}", 
               "password", "{{MailFromPassword}}", 
               "authenticationType", "plain", 
               "starttls", "true" 
       ]
}

现在我收到"You are using a deprecated config setting \"match\" set in email. Deprecated settings will continue to work, but are scheduled for removal from logstash in the future. If you have any questions about this, please visit the #logstash channel on freenode irc." 的错误

谁能帮帮我，我应该如何根据 1.5.4 中的 ERROR 条件配置它？

提前致谢！

Answer 1

正确配置：

if ([LOGLEVEL] =~ /ERROR/) {
   email { 
        from => "{{Mailfrom}}" 
        subject => "ERROR ALERT" 
        to => "{{Rcptto}}" 
        via => "smtp" 
        htmlbody => "<h2>ERROR ALERT</h2><br/><br/><div align='center'>%{message}</div>" 
        options => [ 
               "smtpIporHost", "{{smtpIporHost}}", 
               "port", "{{smtpPort}}", 
               "domain", "{{mailDomain}}", 
               "userName", "{{Mailfrom}}", 
               "password", "{{MailFromPassword}}", 
               "authenticationType", "plain", 
               "starttls", "true" 
       ]
   }
}

解释：

根据deprecated documentation of logstash output emailmatch =>的语法是：

{ "match name", "field.in.event,value.expected, , operand(and/or),field.in.event,value.expected, , or...", "match name", "..." }

在您给定的示例中，该字段为LOGLEVEL，预期值为ERROR。

来自logstash output email的新文档：

此设置已弃用，取而代之的是 Logstash 的“条件” 功能 如果您以前使用过此设置，请使用 代替条件。

检查字段LOGLEVEL是否包含ERROR的相应条件：

if ([LOGLEVEL] =~ /ERROR/) { }