电子邮件未从 Logstash 触发 - ELK 堆栈

Question

我想在事件发生超过阈值限制时从 logstash 触发电子邮件。我已经搜索并获得了一些使用 Mertic 配置的建议，但我没有收到任何电子邮件。下面是我的代码 - 我在这里做错了什么..？请帮忙

// This is my filter
filter{
  if [type] == "agentapp"{
    grok { // no issue with this part
    ...}
    date{ // no issue with this part
    ...}    
  // I have added this below for threshold
  if [message] =~ "Invalid sm_usergroups" {
        metrics {
            meter => ["Invalid sm_usergroups"]
            add_tag => "metric-tag"
        }
    }       
  }
}

// This is my output
output{
  if "metric-tag" in [tags] and ["Invalid sm_usergroups".rate_15m] > 1 {
    email {
    ..//email code is also working one. checked.
    }
  }
}

Answer 1

指标插件有问题，无法正常工作。我们已经手动完成了，bt统计了阈值，最后发送了邮件。