论坛 › ELK › ELK--报错到一定频率 报警发邮件

23213 发表于 2016-4-20 09:35:48

ELK--报错到一定频率 报警发邮件

input {
   file {
    type => "java-err"
    path => "/fsmeeting/tomcat-service/logs/catalina.out"
    tags => "java-err"
    codec => multiline {
       pattern => "^%{TIMESTAMP_ISO8601}"
       negate => true
       what => "previous"
    }
   }
}

filter {
   if == "java-err" {
    grok {
       match => { "message" => "%{TIMESTAMP_ISO8601:date} \[(?<thread_name>.+?)\]-\[(?<log_level>\w+)\]\s*(?<content>.*)"}
    }
    mutate {
       remove_field => "content"
    }
    if == "ERROR" {
         throttle {
                after_count => 2
                key => "%{content}"
                add_tag => "throttled"
         }
    }
    if != "ERROR" {
          drop {}
    }
   }
}

output {
   elasticsearch {
    host => "192.168.5.231"
    protocol => "http"
    index => "java-err-%{+YYYY.MM.dd}"
   }
   if "throttled" not in and == "java-err" and == "ERROR"
   email {
      body => "%{message}"
      from => "xxxxxxx"
      contenttype => "text/plain; charset=UTF-8"
      options => [
                "smtpIporHost", "smtp.sina.com",
                "userName", "xxxxxxx",
                "password", "*********",
                "authenticationType", "login"
      ]
      subject => "服务器%{host} %{type}日志异常"
      to => "xxxxxxxx"
   }
   }
}

fansile 发表于 2016-6-2 23:44:38

Unknown setting 'options' for email"

fansile 发表于 2016-6-2 23:44:55

Unknown setting 'options' for email"求破

查看完整版本: ELK--报错到一定频率 报警发邮件