Logstash email alerts

Question

I configured logstash to send email alerts in case there are some combinations of words in the log message. I get the alerts but instead of receiving the message field value in the alert, I get word "@message". How can I solve this problem?

Here is my logstash config file:

root@srv-syslog:~# cat /etc/logstash/conf.d/central.conf
input {
    syslog {
        type => "syslog"
        port => 5144
    }
    tcp {
        type => "cisco_asa"
        port => 5145
    }
    tcp {
        type => "cisco_ios"
        port => 5146
    }
}
output {
    elasticsearch {
        bind_host => "127.0.0.1"
        port => "9200"
        protocol => http
    }
    if "executed the" in [message]  {
        email {
            from => "[email protected]"
            subject => "logstash alert"
            to => "[email protected]"
            via => "smtp"
            body => "Here is the event line that occured: %{@message}"
        }
    }
}

Answer 1

The field name in this case is message, not @message.

See demo:

input {
    generator {
        count => 1
        lines => ["Example line."]
    }
}

filter {
    mutate {
        add_field => {
            "m1" => "%{message}"
            "m2" => "%{@message}"
        }
    }
}

output {
    stdout {
        codec => rubydebug{}
    }
}

In your case, you should just need to fix the one line:

body => "Here is the event line that occured: %{message}"