使用logstash output 模块 mail{}.判断message关键字.
output {
if "ERROR" in [message] {
email {
to => "xxxx@xxxx"
from => "xxxx@xxxx"
address => "smtp.xxxx"
username => "xxxx@xxxx"
password => "xxxx"
subject => "bxx"
body => "bxx logs"
htmlbody => "%{message}"
}
}
if "hehehe" in [message] {
email {
to => "xxxx@xxxx.com"
from => "xxxx"
address => "smtp.xxxx"
username => "xxxx@xxx"
password => "xxxx"
subject => "bxxx"
body => "bxxxx hehehehe"
htmlbody => "%{message}"
}
}
elasticsearch {
hosts => ["192.168.12.54:9200"]
index => "%{[fields][type]}111-%{+YYYY.MM.dd}"
user => elastic
password => xxxx
}
}