elasticsearch logstash conf文件中的问题

我在logstash conf文件中遇到问题。早些时候它还在工作，但现在我在电子邮件警报块中又添加了一个条件，现在它崩溃了

这是工作部分：

output {
elasticsearch { host => ["HOST1","HOST2"  ] port => "9200" protocol => "http" }
if [severity] in ['Erro', 'ERROR'] {
email {
        from => "testemail@testdomain.com"
        subject => "Attention | Email alert"
        to => "testemail@testdomain.com"
        via => "smtp"
        htmlbody => "<h2>Below log line has been reported</h2><br/><br/><div
        align='left'>%{message}</div>"
        options => [
               "smtpIporHost", "smtp.office365.com",
               "port", "587",
               "domain", "smtp.office365.com",
               "userName", "testemail@testdomain.com",
               "password", "testpwd",
               "authenticationType", "login",
               "starttls", "true"
       ]
}
}
stdout { codec => rubydebug }
}

这里的任何指点都将不胜感激

---

谢谢

问题是您检查了一个不存在的字段。这就是为什么会出现

无法将nil转换为字符串的错误。您的邮件是否包含
[event]
字段？请仔细检查rubydebug输出中的有效字段。它在那里…问题仍然存在..再次检查[event]==“MssTooBusy”而不是“MssTooBusy”中的[event]，但是如果我想在['Erro'、'ERROR']中检查多个值，如['MssTooBusy'、'MtaTooBusy']中的[severity]或[event]，该怎么办？

output {
    elasticsearch { host => ["HOST1","HOST2"  ] port => "9200" protocol => "http" }
    if [severity] in ['Erro', 'ERROR'] or [event] in "MssTooBusy" {
    email {
            from => "testemail@testdomain.com"
            subject => "Attention | Email alert"
            to => "testemail@testdomain.com"
            via => "smtp"
            htmlbody => "<h2>Below log line has been reported</h2><br/><br/><div
            align='left'>%{message}</div>"
            options => [
                   "smtpIporHost", "smtp.office365.com",
                   "port", "587",
                   "domain", "smtp.office365.com",
                   "userName", "testemail@testdomain.com",
                   "password", "testpwd",
                   "authenticationType", "login",
                   "starttls", "true"
           ]
    }
    }
    stdout { codec => rubydebug }
    }

TypeError: can't convert nil into String
       include? at org/jruby/RubyString.java:4464
    output_func at (eval):1449
   outputworker at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.4-java/lib/logstash/pipeline.rb:244
  start_outputs at /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.4-java/lib/logstash/pipeline.rb:166