I installed riemann-0.2.13-1.noarch as an RPM service. I am sending events from logstash 5.2.1, and the plugin I installed is logstash-output-riemann-3.0.0. I wrote the riemann code below to run email. I get an exception. Please indicate to me where I am mistaken.
Riemann configuration:
(let [email (mailer {:host "XXXXX" :port 25 :subject (fn [events] "Consecutive login failed") :body (fn [events] "Hello Team, \n \n There are more consecutive logins failure occured @" (riemann.common/time-at (:timestamp event))"") :from "XXXX"})] (streams ;Check for every 120sec events (fixed-time-window 120 (smap (fn [events] (let [count-of-failures (count (filter #(re-find #"com.thed.server.access.Exception. Please reset credentials for user. Last error occurred was:Authentication failed, please check user credentials*" (:message %)) events))] ;Calculate the count for matched value (event {:status "Class failures" :metric count-of-failures :total-fail (> count-of-failures 1)}))) (where (and (= (:status event) "Class failures") (:total-fail event)) (rollup 1 120 (email "xxx","xxx","xxx") ))prn))))
Error:
WARN [2017-07-06 17:45:49,204] defaultEventExecutorGroup-2-1 - riemann.streams - riemann.streams$smap$stream__6639@55d73fdc threw java.lang.NullPointerException: null at java.util.regex.Matcher.getTextLength(Matcher.java:1283) at java.util.regex.Matcher.reset(Matcher.java:309) at java.util.regex.Matcher.<init>(Matcher.java:229) at java.util.regex.Pattern.matcher(Pattern.java:1093) at clojure.core$re_matcher.invokeStatic(core.clj:4674) at clojure.core$re_find.invokeStatic(core.clj:4716) at clojure.core$re_find.invoke(core.clj:4716) at riemann.config$eval88$fn__93$fn__94.invoke(riemann.config:48) at clojure.core$filter$fn__4812.invoke(core.clj:2708) at clojure.lang.LazySeq.sval(LazySeq.java:40) at clojure.lang.LazySeq.seq(LazySeq.java:49) at clojure.lang.RT.seq(RT.java:521) at clojure.lang.RT.countFrom(RT.java:625) at clojure.lang.RT.count(RT.java:618) at riemann.config$eval88$fn__93.invoke(riemann.config:48) at riemann.streams$smap$stream__6639.invoke(streams.clj:161) at riemann.streams$fixed_time_window_fn$stream__6889$fn__6922.invoke(streams.clj:374) at riemann.streams$fixed_time_window_fn$stream__6889.invoke(streams.clj:374) at riemann.core$stream_BANG_$fn__8578.invoke(core.clj:19) at riemann.core$stream_BANG_.invokeStatic(core.clj:18) at riemann.core$stream_BANG_.invoke(core.clj:14) at riemann.transport$handle.invokeStatic(transport.clj:171) at riemann.transport$handle.invoke(transport.clj:165) at riemann.transport.tcp$tcp_handler.invokeStatic(tcp.clj:95) at riemann.transport.tcp$tcp_handler.invoke(tcp.clj:88) at riemann.transport.tcp$gen_tcp_handler$fn__11550.invoke(tcp.clj:66) at riemann.transport.tcp.proxy$io.netty.channel.ChannelInboundHandlerAdapter$ff19274a.channelRead(Unknown Source) at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:372) at io.netty.channel.AbstractChannelHandlerContext.access$600(AbstractChannelHandlerContext.java:38) at io.netty.channel.AbstractChannelHandlerContext$7.run(AbstractChannelHandlerContext.java:363) at io.netty.util.concurrent.DefaultEventExecutor.run(DefaultEventExecutor.java:66) at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:877) at io.netty.util.concurrent.DefaultThreadFactory$DefaultRunnableDecorator.run(DefaultThreadFactory.java:144) at java.lang.Thread.run(Thread.java:745)
Whenever I use (let [count-of-failures (count (filter #(re-find #"com.thed.server.access.Exception. Please reset credentials for user. Last error occurred was:Authentication failed, please check user credentials*" (:message %)) events))] . This throws me the above exception, but when I use (let [count-of-failures (count (filter #(= "com.thed.server.access.Exception. Please reset credentials for user. Last error occurred was:Authentication failed, please check user credentials" (:message %)) events))] . Emailing it
source share