[elk@Vsftp logstash]$ cat t3.conf
input {
stdin {
}
}
filter {
grok {
match => [ "message","(?m)s*%{TIMESTAMP_ISO8601:time}s*(?<Level>(S+)).*"]
}
date {
match => ["time", "yyyy-MM-dd HH:mm:ss,SSS"]
}
mutate {
add_field =>["type","tailong"]
add_field =>["messager","%{type}-%{message}"]
remove_field =>["message"]
}
}
output {
if ([Level] == "ERROR" or [messager] =~ "Exception" ) and [messager] !~ "温金服务未连接" and [messager] !~ "调用温金代理系统接口错误" and [messager] !~ "BusinessException" {
exec {
command => "/bin/smail.pl "%{messager}" "%{type}" "
}
}
stdout {
codec =>rubydebug
}
}
Vsftp:/root# cat /bin/smail.pl
#!/usr/bin/perl
use Net::SMTP;
use HTTP::Date qw(time2iso str2time time2iso time2isoz);
use Data::Dumper;
use Getopt::Std;
use vars qw($opt_d );
getopts('d:');
# mail_user should be your_mail@163.com
$message= "@ARGV";
$env="$opt_d";
sub send_mail{
my $CurrTime = time2iso(time());
my $to_address = shift;
my $mail_user = 'zhao.yangjian@163.com';
my $mail_pwd = 'xx';
my $mail_server = 'smtp.163.com';
my $from = "From: $mail_user
";
my $subject = "Subject: zjcap info
";
my $info = "$CurrTime--$message";
my $message = <<CONTENT;
$info
CONTENT
my $smtp = Net::SMTP->new($mail_server);
$smtp->auth($mail_user, $mail_pwd) || die "Auth Error! $!";
$smtp->mail($mail_user);
$smtp->to($to_address);
$smtp->data(); # begin the data
$smtp->datasend($from); # set user
$smtp->datasend($subject); # set subject
$smtp->datasend("
");
$smtp->datasend("$message
"); # set content
$smtp->dataend();
$smtp->quit();
};
send_mail ('zhao.yangjian@163.com');
2017-01-12 10:19:19,888 jjjjj Exception
{
"@version" => "1",
"@timestamp" => "2017-01-12T02:19:19.888Z",
"host" => "Vsftp",
"time" => "2017-01-12 10:19:19,888",
"Level" => "jjjjj",
"type" => "tailong",
"messager" => "tailong-2017-01-12 10:19:19,888 jjjjj Exception"
}