logstash 调用exec

[elk@Vsftp logstash]$ cat t3.conf 
input {
        stdin {
        }
     
     
}  
filter {
    grok {
        match => [ "message","(?m)s*%{TIMESTAMP_ISO8601:time}s*(?<Level>(S+)).*"]
     }
     date {
        match => ["time", "yyyy-MM-dd HH:mm:ss,SSS"]
    }
   mutate {
                       add_field =>["type","tailong"]
                       add_field =>["messager","%{type}-%{message}"]
                       remove_field =>["message"]
                }
}  
output {  
    if ([Level]  == "ERROR" or [messager] =~ "Exception" ) and [messager] !~ "温金服务未连接" and  [messager] !~ "调用温金代理系统接口错误" and [messager] !~ "BusinessException"  {
       exec {
         command  =>  "/bin/smail.pl   "%{messager}" "%{type}" "
    }
   }
   stdout {  
   codec =>rubydebug  
   }  
}


Vsftp:/root# cat /bin/smail.pl 
#!/usr/bin/perl 
use Net::SMTP;
use HTTP::Date qw(time2iso str2time time2iso time2isoz);  
use Data::Dumper;
use Getopt::Std;
use vars qw($opt_d );
getopts('d:');
# mail_user should be your_mail@163.com
    $message= "@ARGV";
    $env="$opt_d";
    sub send_mail{
    my $CurrTime = time2iso(time());
    my $to_address  = shift;
    my $mail_user   = 'zhao.yangjian@163.com';
    my $mail_pwd    = 'xx';
    my $mail_server = 'smtp.163.com';

    my $from    = "From: $mail_user
";
    my $subject = "Subject: zjcap info
";
    my $info = "$CurrTime--$message";
    my $message = <<CONTENT; 
     $info
CONTENT
    my $smtp = Net::SMTP->new($mail_server);

    $smtp->auth($mail_user, $mail_pwd) || die "Auth Error! $!";
    $smtp->mail($mail_user);
    $smtp->to($to_address);

    $smtp->data();             # begin the data
    $smtp->datasend($from);    # set user
    $smtp->datasend($subject); # set subject
    $smtp->datasend("

");
    $smtp->datasend("$message
"); # set content
    $smtp->dataend();
    $smtp->quit();
};


send_mail ('zhao.yangjian@163.com');



2017-01-12 10:19:19,888 jjjjj Exception

{
      "@version" => "1",
    "@timestamp" => "2017-01-12T02:19:19.888Z",
          "host" => "Vsftp",
          "time" => "2017-01-12 10:19:19,888",
         "Level" => "jjjjj",
          "type" => "tailong",
      "messager" => "tailong-2017-01-12 10:19:19,888 jjjjj Exception"
}



                                    
原文地址:https://www.cnblogs.com/hzcya1995/p/13349926.html