logstash-plugins / logstash-output-slack

Reviews of the code/contributions are very welcome (particularly with testing!), since I don't really know Ruby.

Logstash Slack Output Plugin

This is a plugin for Logstash that pushes log events to Slack using their incoming webhooks API.

It is fully free and fully open source. The license is Apache 2.0, meaning you are pretty much free to use it however you want in whatever way.

======= Logstash provides infrastructure to automatically generate documentation for this plugin. We use the asciidoc format to write documentation so any comments in the source code will be first converted into asciidoc and then into html. All plugin documentation are placed under one central location.

• For formatting code or config example, you can use the asciidoc [source,ruby] directive
• For more asciidoc formatting tips, see the excellent reference here https://github.com/elastic/docs#asciidoc-guide.

Need Help?

Need help? Try #logstash on freenode IRC or the https://discuss.elastic.co/c/logstash discussion forum.

Usage

input {
    ...
}

filters {
    ...
}

output {
    ...
    slack {
        url => <YOUR SLACK WEBHOOK URL HERE>
        channel => [channel-name - optional]
        username => [slack username - optional]
        icon_emoji => [emoji, something like ":simple_smile:" - optional]
        icon_url => [icon url, would be overriden by icon_emoji - optional]
        format => [default is "%{message}", but used to format the text - optional]
        attachments => [an array of attachment maps as specified by the slack API - optional; if there is an "attachments" field in the event map and it is valid, it will override what is configured here, even if it's empty]
    }
}

Contributing

All contributions are welcome: ideas, patches, documentation, bug reports, complaints, and even something you drew up on a napkin.

Programming is not a required skill. Whatever you've seen about open source and maintainers or community members saying "send patches or die" - you will not see that here.

It is more important to the community that you are able to contribute.

For more information about contributing, see the CONTRIBUTING file.

logstash-output-slack's Issues

After installing plugin, Logstash cannot be viewed from Kibana

This is a Dockerfile:

FROM logstash:5.3.0

RUN logstash-plugin install logstash-output-slack

COPY logstash.conf /usr/share/logstash/pipeline/

CMD ["-f", "/usr/share/logstash/pipeline/logstash.conf"]

logstash.yml:

http.host: "0.0.0.0"
xpack.monitoring.elasticsearch.url: http://elasticsearch:9200
xpack.monitoring.elasticsearch.username: logstash_system
xpack.monitoring.elasticsearch.password: changeme
#xpack.monitoring.enabled: false

Logstash log says Logstash started successfully, there are no any errors logs neither in Logstash nor in ES. Logstash works well but cannot be viewed from Kibana.

Logstash stopped processing because of an error: (SystemExit) exit

Logstash : logstash-oss-6.5.1.tar.gz
OS: Red Hat Enterprise Linux Server release 6.9 (Santiago)
config： slack {
url => "xxxxxxxxx"
channel => "alert"
username => logstash
icon_emoji => ":redsiren:"
attachments => [{text => "%{message}"}]
format => "OOM occurred on %{host}"
}

ERROR message ：
[2019-01-08T07:41:19,207][FATAL][logstash.runner ] An unexpected error occurred! {:error=>#<JSON::ParserError: unexpected token at '{"text":"2018-12-17 13:40:29 ERROR [com.common.system.filter.TLThreadContextFilter] -f4363092-936e-4465-80e2-bc2edb9f61df- catching
javax.servlet.ServletException: java.lang.OutOfMemoryError: Java heap space
af.common.system.dao.ldap.ApplicationDaoImpl] -94ef0b94-13e7-417e-9a75-f988923e8e4b- App: 749, urlmapping: , not retrieved from cache"}'>, :backtrace=>["json/ext/Parser.java:250:in parse'", "/opt/logstash-6.5.1/vendor/bundle/jruby/2.3.0/gems/json-1.8.6-java/lib/json/common.rb:155:in parse'", "/opt/logstash-6.5.1/vendor/bundle/jruby/2.3.0/gems/logstash-output-slack-2.1.1/lib/logstash/outputs/slack.rb:64:in block in receive'", "org/jruby/RubyArray.java:2486:in map'", "/opt/logstash-6.5.1/vendor/bundle/jruby/2.3.0/gems/logstash-output-slack-2.1.1/lib/logstash/outputs/slack.rb:64:in receive'", "/opt/logstash-6.5.1/logstash-core/lib/logstash/outputs/base.rb:89:in block in multi_receive'", "org/jruby/RubyArray.java:1734:in each'", "/opt/ibm/logstash-6.5.1/logstash-core/lib/logstash/outputs/base.rb:89:in multi_receive'", "org/logstash/config/ir/compiler/OutputStrategyExt.java:114:in multi_receive'", "org/logstash/config/ir/compiler/AbstractOutputDelegatorExt.java:97:in multi_receive'", "/opt/logstash-6.5.1/logstash-core/lib/logstash/pipeline.rb:373:in block in output_batch'", "org/jruby/RubyHash.java:1343:in each'", "/opt/logstash-6.5.1/logstash-core/lib/logstash/pipeline.rb:372:in output_batch'", "/opt/logstash-6.5.1/logstash-core/lib/logstash/pipeline.rb:324:in worker_loop'", "/opt/logstash-6.5.1/logstash-core/lib/logstash/pipeline.rb:286:in `block in start_workers'"]}
[2019-01-08T07:41:19,430][ERROR][org.logstash.Logstash ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

Thanks

Slack output breaks when there are linebreaks in the attachments' fields

• 6.0.1
• Docker running on Ubuntu

Config file

	slack {
			url =>"https://something"
			username => "slack-output-test"
			format => "%{[docker][labels][io_rancher_project_name]} "
			attachments => [
				{
					color =>  "good"
					pretext => "%{message}"
					fields => [
						{ rancher_stack => "%{[docker][labels][io_rancher_project_name]}" }
					]
				}

			]
		}

Sample data

Any thing that contains a linebreak in the message field breaks it.

Error from logstash log

 An unexpected error occurred! {:error=>#<JSON::ParserError: unexpected token at '{"color":"good","pretext":"System.ArgumentException: Requested value 'chabelosite' was not found.
8/27/2018 1:18:28 PM   at System.Enum.TryParseEnum(Type enumType, String value, Boolean ignoreCase, EnumResult& parseResult)
8/27/2018 1:18:28 PM   at System.Enum.Parse(Type enumType, String value, Boolean ignoreCase)
8/27/2018 1:18:28 PM   at Saongroup.TechIntegration.Common.MVC.SiteRequestModelBinder.GetRequestType(String site, Type baseRequestType)
8/27/2018 1:18:28 PM   at Saongroup.TechIntegration.Common.MVC.SiteRequestModelBinder.BindModelAsync(ModelBindingContext bindingContext)
8/27/2018 1:18:28 PM   at Microsoft.AspNetCore.Mvc.ModelBinding.ParameterBinder.BindModelAsync(ActionContext actionContext, IModelBinder modelBinder, IValueProvider valueProvider, ParameterDescriptor parameter, ModelMetadata metadata, Object value)
8/27/2018 1:18:28 PM   at Microsoft.AspNetCore.Mvc.Internal.ControllerBinderDelegateProvider.<>c__DisplayClass0_0.<<CreateBinderDelegate>g__Bind|0>d.MoveNext()
8/27/2018 1:18:28 PM--- End of stack trace from previous location where exception was thrown ---
8/27/2018 1:18:28 PM   at Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker.InvokeInnerFilterAsync()
8/27/2018 1:18:28 PM   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeNextExceptionFilterAsync()","fields":[{"rancher_stack":"gdpr-rtbf-deploy-dev"}]}'>

Unable to insert new lines in format field for message formatting

Hi,

For better viewing my message in Slack, I want to insert new lines into my message/format field of logstash-output-slack plugin. But when I do something like this

output {
  slack {
    ...
    format => "line 1 \n line 2"
    ...
  }
}

I am getting a message in my slack as line 1 \n line 2 but not as two different lines. I think, the format field is being received as line 1 \\n line 2 by your plugin. Can you do anything to fix that? Thanks!

Attachment fields do not have replaced event variables

I am trying to send messages to slack. The issue us that I am not getting replaced values when dealing with attachments. The variable replacement for %{[fields][app]} does not happen in the attachment title. It is working perfectly fine in format though.

• Version: 2.0.1
• Logstash version : 5.3.0
• Operating System: Ubuntu
• Config File:
  slack {
  url =>
  channel => "%{error_alerts_slack_channel}"
  attachments => [{
  "fallback" => "Error in %{[fields][app]}\nEnv - %{[fields][env]}\nRequest - %{requestid}\nServer Time - %{@timestamp}\n\n%{message}"
  "color" => "danger"
  "title" => "Error in %{[fields][app]}"
  "text" => "%{message}"
  "fields" => [{
  "title" => "Application"
  "value" => "%{[fields][app]}"
  "short" => true
  }, {
  "title" => "Env"
  "value" => "%{[fields][env]}"
  "short" => true
  }, {
  "title" => "Request"
  "value" => "%{requestid}"
  "short" => true
  }, {
  "title" => "Server Time"
  "value" => "%{@timestamp}"
  "short" => true
  }]
  }]
  }

Getting Error While installing plugin in logstash-7.0.1

Hi Guys,

Unable to install slack output in logstash-7.0.1 can you please check

console logs for reference.

logstash]$ bin/logstash-plugin install logstash-output-slack
Validating logstash-output-slack
Installing logstash-output-slack
Plugin version conflict, aborting
ERROR: Installation Aborted, message: Bundler could not find compatible versions for gem "logstash-codec-plain":
  In snapshot (Gemfile.lock):
    logstash-codec-plain (= 3.0.6)

  In Gemfile:
    logstash-input-azure_event_hubs java was resolved to 1.1.0, which depends on
      logstash-codec-plain java

    logstash-output-slack java was resolved to 0.1.4, which depends on
      logstash-codec-plain (>= 1.0.0, ~> 2.0.0) java

Running `bundle update` will rebuild your snapshot from scratch, using only
the gems in your Gemfile, which may resolve the conflict.

Bundler could not find compatible versions for gem "logstash-core":
  In snapshot (Gemfile.lock):
    logstash-core (= 7.0.1)

  In Gemfile:
    logstash-core java

    logstash-core-plugin-api java was resolved to 2.1.16, which depends on
      logstash-core (= 7.0.1) java

    logstash-input-syslog java was resolved to 3.4.1, which depends on
      logstash-filter-grok java was resolved to 4.0.4, which depends on
        logstash-core (>= 5.6.0) java

    logstash-output-slack java was resolved to 0.1.1, which depends on
      logstash-core (>= 1.4.0, < 2.0.0) java

Running `bundle update` will rebuild your snapshot from scratch, using only
the gems in your Gemfile, which may resolve the conflict.

Bundler could not find compatible versions for gem "public_suffix":
  In snapshot (Gemfile.lock):
    public_suffix (= 3.0.3)

  In Gemfile:
    logstash-input-twitter java was resolved to 4.0.0, which depends on
      public_suffix (~> 3) java

    logstash-output-slack java was resolved to 2.1.1, which depends on
      public_suffix (< 1.5.0) java

Running `bundle update` will rebuild your snapshot from scratch, using only
the gems in your Gemfile, which may resolve the conflict.

Is this project essentially dead?

There haven't been any updates for a while. Installing this plugin for a reasonably recent logstash seems to fail. Is there any alternative to it or hope for resurrection?

Unable to install in **Logstash 7.8.0**

Unable to install in Logstash 7.8.0, Having below error.

ERROR: Installation Aborted, message: Bundler could not find compatible versions for gem "logstash-codec-plain":
  In snapshot (Gemfile.lock):
    logstash-codec-plain (= 3.0.6)

  In Gemfile:
    logstash-input-jms java was resolved to 3.1.2, which depends on
      logstash-codec-plain (~> 3.0) java

    logstash-output-slack java was resolved to 0.1.4, which depends on
      logstash-codec-plain (>= 1.0.0, ~> 2.0.0) java

Any plans to support newer versions?

Logstash 8.10.0-1

Hi,
I have tested the new logstash 8.10.0-1 and it seems that slack output plugin no longer works :

root@XXXXXX:/var/tmp# /usr/share/logstash/bin/logstash-plugin install logstash-output-slack
Using bundled JDK: /usr/share/logstash/jdk
Validating logstash-output-slack
Resolving mixin dependencies
Installing logstash-output-slack
Plugin version conflict, aborting
ERROR: Installation Aborted, message: Bundler found conflicting requirements for the Ruby version:
In Gemfile:
logstash-output-slack was resolved to 2.2.0, which depends on
Ruby (> 2)
Current Ruby version:
Ruby (= 3.1.0)
Bundler could not find compatible versions for gem "logstash-codec-plain":
In Gemfile:
logstash-input-jms was resolved to 3.2.2, which depends on
logstash-codec-plain (> 3.0)
logstash-output-slack was resolved to 0.1.4, which depends on
logstash-codec-plain (>= 1.0.0, ~> 2.0.0)
Bundler could not find compatible versions for gem "logstash-core":
In Gemfile:
logstash-core-plugin-api was resolved to 2.1.16, which depends on
logstash-core (= 8.10.0)
logstash-input-jms was resolved to 2.0.1, which depends on
logstash-core (< 3.0.0, >= 2.0.0.snapshot)


I have tested it on Ubuntu 22.04 OS.

Many thanks for your feedback.

Logstash 5.0 support

/usr/share/logstash/bin/logstash-plugin install logstash-output-slack

...
Bundler could not find compatible versions for gem "logstash-core":
  In snapshot (Gemfile.lock):
    logstash-core (= 5.0.0)

  In Gemfile:
    logstash-core-plugin-api (>= 0) java depends on
      logstash-core (= 5.0.0) java

    logstash-output-slack (>= 0) java depends on
      logstash-core (< 2.0.0, >= 1.4.0) java

    logstash-core (>= 0) java