json型數據，logstash郵件報警配置案例

[root@mysql ~]# cat /usr/local/logstash-2.2.0/etc/test1.conf 
input {
#   stdin {
#         type => "yeshuai"
#         codec => "json"
#        }
file {
    type => "yeshuai"
    path => ["/opt/log/test.log"]
    start_position => "beginning"
    codec=>"json"
       }


}
filter {
if [type] == "yeshuai" {
 throttle {
                period => 40
                before_count => 4
                after_count => 4              
                key => "%{type}"
                add_tag => "throttled"
           }
                       }

}
output {

if "throttled" not in [tags] {
email    {
        port           =>    "25"
        address        =>    "smtp.qq.com"
        username       =>    "[email protected]"
        password       =>    "*****"
        authentication =>    "plain"
        use_tls        =>    false
        from           =>    "[email protected]"
        subject        =>    "服務器error警報"
        to             =>    "[email protected]"
        via            =>    "smtp"
        body           =>    "you hava an error of plat_inter_error in host 192.168.1.224!
                              "
         }
                             }
 elasticsearch {
        hosts => ["192.168.1.224:9200"]
        index => "logstash-%{type}-%{+YYYY.MM.dd}"
        document_type => "%{type}"
        workers => 1
        flush_size => 20000
        idle_flush_time => 10
        template_overwrite => true
               }
}