Need help in configuring email alert in logstash 1.5.4 - logstash

Question

I was using logstash 1.4.2 and this email alert was working fine at that time. Now my system is upgraded to logstash 1.5.4 and logstash is failing because of older settings as below:
email {
from => "{{Mailfrom}}"
match => [ "ERROR ALERT", "LOGLEVEL,ERROR" ]
subject => "%{matchName}"
to => "{{Rcptto}}"
via => "smtp"
htmlbody => "<h2>%{matchName}</h2><br/><br/><div
align='center'>%{message}</div>"
options => [
"smtpIporHost", "{{smtpIporHost}}",
"port", "{{smtpPort}}",
"domain", "{{mailDomain}}",
"userName", "{{Mailfrom}}",
"password", "{{MailFromPassword}}",
"authenticationType", "plain",
"starttls", "true"
]
}
Now I am getting error as "You are using a deprecated config setting \"match\" set in email. Deprecated settings will continue to work, but are scheduled for removal from logstash in the future. If you have any questions about this, please visit the #logstash channel on freenode irc."
Can anyone help me here, as how should i configure it according to ERROR condition in 1.5.4?
Thanks in advance!

Answer 1

Correct configuration:
if ([LOGLEVEL] =~ /ERROR/) {
email {
from => "{{Mailfrom}}"
subject => "ERROR ALERT"
to => "{{Rcptto}}"
via => "smtp"
htmlbody => "<h2>ERROR ALERT</h2><br/><br/><div align='center'>%{message}</div>"
options => [
"smtpIporHost", "{{smtpIporHost}}",
"port", "{{smtpPort}}",
"domain", "{{mailDomain}}",
"userName", "{{Mailfrom}}",
"password", "{{MailFromPassword}}",
"authenticationType", "plain",
"starttls", "true"
]
}
}
Explanation:
According to the deprecated documentation of logstash output email the syntax of match => is:
{ "match name", "field.in.event,value.expected, , operand(and/or),field.in.event,value.expected, , or...", "match name", "..." }
In your given example the field is LOGLEVEL and the expected value is ERROR.
From the new documentation of logstash output email:
This setting is deprecated in favor of Logstash’s "conditionals"
feature If you were using this setting previously, please use
conditionals instead.
The corresponding conditional that checks if field LOGLEVEL contains ERROR:
if ([LOGLEVEL] =~ /ERROR/) { }