向多个收件人发送 logstash 邮件

Question

在 logstash conf 过滤器中，我将多个电子邮件 ID 分配给变量（变量名称 = targetmailid）和输出字段，我正在尝试使用该变量。但是，它在输出中将多个电子邮件 ID 分配给 CC 字段。请提出建议。

filter {
        kv {
                field_split => ","
                value_split=>":"

        }

        if [ref_type] =~ /tag/ {
                ruby {

                     code => "tag= event['ref']

                                 targetmailid = 'testuser1@mail.com,testuser2@mail.com,testuser3@mail.com' 

                              }
                    }
        }


        output {

        if "tagcreate" in [tags] {
                email {
                        body => "test messgage"
                        from => "admin@emil.com"
                        to => "admin2@email.com"
                        cc =>  "targetmailid"
                        subject => "test mail"
                        options => {
                            smtpIporHost => "smtp"
                            port => 25
                                   }
                                }
                        }

Answer 1

您需要像这样使用 sprintf 格式%{...}：

email {
    body => "test messgage"
    from => "admin@emil.com"
    to => "admin2@email.com"
    cc =>  "%{targetmailid}"         <--- modify this
    subject => "test mail"
    options => {
        smtpIporHost => "smtp"
        port => 25
    }
}

更新

还要确保修改以下部分：

    if [ref_type] =~ /tag/ {
       ruby {
           code => "event['targetmailid'] = 'testuser1@mail.com,testuser2@mail.com,testuser3@mail.com'"
       }
    } else {
       mutate {
          add_field => { "targetmailid" => ""}
       }
    }

向多个收件人发送 logstash 邮件

logstash mail to multiple recipients

logstash

logstash-configuration