Elastalert implementation alarm based on log alarm plug-in

1. Official http://elastalert.readthedocs.io/en/latest/

2. Example of alarm rules

Http://elastalert.readthedocs.io/en/latest/elastalert.html#rule-types

Admin_asdsa.yaml: |
Name:admin_asdsa
Type:frequency
Owner:admin
Description: "2018-06-13 17:54:55"
index:logstash-*
Num_events:1
Is_enabled:false
Timeframe:
Minutes:60
Filter
-Query:
Query_string:
Query: ' Kubernetes.labels.name:test '
-Query:
Query_string:
Query: ' Kubernetes.namespace_name:admin '
-Query:
Wildcard
LOG: ' *listening* '
Regex: ' *listening* '
Alert
-Email
Smtp_host:smtp.exmail.qq.com
smtp_port:465
Smtp_ssl:true
FROM_ADDR: [Email protected]
Smtp_auth_file:/opt/config/email_config.yaml
Email
-[Email protected]
Alert_subject: ' [XXX] alarm reminder '
Alert_text_type:alert_text_only
Alert_text: "Dear + + User: \ n \ nyou have triggered your service {} Log alert according to the {} policy you set in" Manage and log "-[Alarm settings], log regular
{} has appeared {} times! \n\n\n above questions please handle as soon as possible, thank you! "
Alert_text_args:
-Name
-Kubernetes.labels.name
-Regex
-Num_hits

3. Configuration files

Http://elastalert.readthedocs.io/en/latest/elastalert.html#configuration

Elastalert_config: |
---
Rules_folder:/opt/rules
Scan_subdirectories:false
Run_every:
Minutes:1
Buffer_time:
Minutes:15
Es_host:elasticsearch-logging
es_port:9200
Writeback_index:elastalert_status
Use_ssl:false
Alert_time_limit:
Days:2
Email_config: |
---
User: [Email protected]
Password:xxxx

4. Specific rule types, and Alarm methods view official documents

Elastalert implementation alarm based on log alarm plug-in