用logstash发邮件告警

logstash input http

该输入插件会让logstash在一个端口上监听http请求，用户可以通过http请求发送告警请求。

input {
    http {
        host => "0.0.0.0"
        port => 9500
        type => "heartbeat"
        user => "loguser"
        password => "logpwd"
        #codec => json{}
    }
}

• 如果设置了user,password，则发送http请求时需要Auth Basic验证
• 如果http请求header包含：Content-Type: application/json，则http插件将自动调用codec json将输入内容解析成json格式
• 发送请求：

POST http://localhost:9500
{
  "appid": "app_heaertbead_monit",
  "to": "[e-mail]",
  "subject": "heaertbead monit",
  "body": "heaertbead monit body"
}

logstash output email

output {
    if [type] == "heartbeat" {
        email {
            to => "%{to}"
            from => "[e-mail]"
            address => "smtp.qq.com"
            username => "username "
            password => "password "
            subject => "%{subject}"
            body => "%{body}"
            htmlbody => ""
        }
    }

    #同时也经redis再保存到elasticsearch中
    redis {
        host => '172.16.18.116'
        data_type => 'list'
        key => 'logstash:redis'
    }
}