logstash/logstash — pull request #132 by NickPadilla (2012-03-29 15:47:15+00:00)
Title: Email Notification Plugin 

This new plugin sends emails via the configuration. You have tight control over when the notifications get sent. However, due to the way we write the hashs in Logstash configuration file the syntax for the match element is a bit different. The syntax does allow for a greater variation for each match. The plugin also supports HTML emails and carbon copy. You can also send to many email addresses in the fields if needed. Currently only SMTP is verified and known to be working.

The syntax of the match field is like this, just so its out there:

{ "match name", "field.in.event,value.expected, , operand(and/or),field.in.event,value.expected, , or...",
"match name", "..." }

just need to separate the operands by putting an empty value before it. Tested the AND/OR logic and it seems to be working as expected. Supports equal(default), not equal(!), greater than(>), less than(<), greater than or equal(>=), less than or equal(<=), contains(*), does not contain(!*)

To use these conditionals you just add it to the first part of the value :

{ "match name", "field.in.event,<=value.expected, , operand(and/or),field.in.event,*value.expected, , or...",
"match name", "..." }

Please keep in mind that the less than and greater than conditionals are only meant for numbers, the contains conditionals are meant for string values. This is just a brief sum up. Let me know if there are any questions.