为电子邮件输出configurationlogstash时出现问题

我试图configurationlogstash发送电子邮件警报和日志输出在elasticsearch / kibana。

我有通过rsyslog成功同步的日志，但我运行时遇到以下错误

/opt/logstash-1.4.1/bin/logstash代理-f /opt/logstash-1.4.1/logstash.conf –configtest

错误：期望在第23行，第12列（字节387）之后的＃，{，,,]过滤{if [program] ==“nginx-access”{

• 在创build第一个索引后，Elasticsearch集群状态立即变为黄色
• 无法访问弹性search的pid文件
• 为Windows设置内存映射文件限制？
• 在谷歌计算引擎ELK堆栈
• 将docker日志发送到logstash

grok {match => [“message”，“％{IPORHOST：remote_addr} – ％{USERNAME：remote_user} [％{HTTPDATE：time_local}]％{QS：request}％{INT：status}％{INT：body_bytes_sent} ％{QS：http_referer}％{QS：http_user_agent}“]}}}

输出{stdout {} elasticsearch {embedded式=>假主机=>“

这是我的logstashconfiguration文件

input { syslog { type => syslog port => 5544 } } filter { if [program] == "nginx-access" { grok { match => [ "message" , "%{IPORHOST:remote_addr} - %{USERNAME:remote_user} \[% {HTTPDATE:time_local}\] %{QS:request} %{INT:status} %{INT:body_bytes_sent} %{QS:http_referer} %{QS:http_user_agent}” ] } } } output { stdout { } elasticsearch { embedded => false host => "localhost" cluster => "cluster01" } email { from => "[email protected]" match => [ "Error 504 Gateway Timeout", "status,504", "Error 404 Not Found", "status,404" ] subject => "%{matchName}" to => "[email protected]" via => "smtp" body => "Here is the event line that occured: %{@message}" htmlbody => "<h2>%{matchName}</h2><br/><br/><h3>Full Event</h3><br/><br/><div align='center'>%{@message}</div>" } } 

我已经检查了错误中引用的第23行，它看起来很好….我试着拿出filter，一切正常…没有改变这条线。

请帮忙

编辑

我现在改变了我的configuration

 input { syslog { type => syslog port => 5544 } } filter { grok { type => "syslog" match => ["syslog_program","nginx-access"] match => [ "message","%{IPORHOST:remote_addr} - %{USERNAME:remote_user} \[%{HTTPDATE:time_local}\] %{QS:request} %{INT:status} %{INT:body_bytes_sent} %{QS:http_referer} %{QS:http_user_agent}" ] add_field => [ "nginx_response", "%{NUMBER:response}" ] } } output { stdout {} elasticsearch { embedded => false host => "localhost" cluster => "cluster01" } email { match => [ "status", "status,304"] to => "[email protected]" from => "[email protected]" options => [ "smtpIporHost", "", "port", "", "userName", "", "password", "", "starttls", "", "authenticationType", "" ] via => "smtp" # or pop or sendmail subject => "Found %{IP:client} Alert on %{@source_host}" body => "Here is the event line %{@message}" htmlbody => "<h2>%{matchName}</h2><br/><br/><h3>Full Event</h3><br/><br/><div align='center'>%{@message}</div>" } } 

这似乎工作，尽可能多的我可以看到，它现在认识到logstash中的东西，并有一个电子邮件插件命令那里，但比赛失败…..任何想法？

谢谢

 if [message] =~ /nginx-access/ {