Not getting each error email alert from logstash 1

Question

I have my ELK setup like below:

HOST1: Component(which generates log) + Logstash (To send logs to redis)

HOST2: Redis + Elasticsearch + Logstash ( To parse data based on grok and send it to elasticsearch on same setup)

HOST3: Redis + Elasticsearch + Logstash ( To parse data based on grok and send it to elasticsearch on same setup)

HOST4: nginx + Kibana 4

Now when I send one error log line from logstash to redis, I get double entry in Kibana 4. Like below:

Plus I didnt get any email alert from logstash, although it is configured to send alert when severity == "Erro".

this is part of logstash conf file:

output {
elasticsearch { host => ["<ELK IP>"]  port => "9200" protocol => "http" }
if [severity] =~ /Erro/
{
email {
        from => "[e-mail]"
        subject => "Error Alert"
        to => "[e-mail]"
        via => "smtp"
        htmlbody => "<h2>Error Alert1</h2><br/><br/><div
        align='center'>%{message}</div>"
        options => [
               "smtpIporHost", "smtp.office365.com",
               "port", "587",
               "domain", "smtp.office365.com",
               "userName", "[e-mail]",
               "password", "somepasswd",
               "authenticationType", "login",
               "starttls", "true"
       ]
}
}
stdout { codec => rubydebug }
}

I am using following custom grok pattern to parse log line:

ABTIMESTAMP %{YEAR}%{MONTHNUM2}%{MONTHDAY} %{USERNAME}
ABLOGLEVEL (Note|Erro|Fatl|Warn|Urgt)
ABLOG %{ABTIMESTAMP:timestamp} %{HOST:hostname} %{WORD:servername} %{INT:pid} %{INT:lwp} %{INT:thread} %{ABLOGLEVEL:severity};%{USERNAME:event}\(%{NUMBER:msgcat}/%{NUMBER:msgnum}\)%{GREEDYDATA:greedydata}

Any help here as, how to get each email alert for every error log line?

Thanks in advance!

Answer 1

resolved it... Actually I was having multiple conf files in logstash/conf.d folder. I removed all unnecessary files and only kept my conf file and now its working. :). Thank you Val for your help