ElastAlert不工作

Question

我想在elastAlert上制定规则。

Config.yaml

rules_folder: example_rules


run_every:
  minutes: 1


buffer_time:
  minutes: 1


es_host: localhost


es_port: 9200


writeback_index: elastalert_status

alert_time_limit:
  days: 2

example_rules / example_frequency.yaml：

 name: Example rule


 type: frequency


 index: sample



 num_events: 1


 timeframe:
    hours: 4 


 filter:
 - term:
     message: "hi"


 alert:
 - "email"


 email:
 - "abc@example.com"

当我这样做时：

GET sample/_search?q=*

我明白了：

{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 4,
    "max_score": 1,
    "hits": [
      {
        "_index": "sample",
        "_type": "blog",
        "_id": "2",
        "_score": 1,
        "_source": {
          "@timestamp": "2016-05-27T17:32:00",
          "message": "hi"
        }
      },
      {
        "_index": "sample",
        "_type": "blog",
        "_id": "4",
        "_score": 1,
        "_source": {
          "@timestamp": "2016-05-27T12:15:00",
          "message": "hi"
        }
      },
      {
        "_index": "sample",
        "_type": "blog",
        "_id": "1",
        "_score": 1,
        "_source": {
          "@timestamp": "2016-05-27T17:25:00",
          "message": "hi"
        }
      },
      {
        "_index": "sample",
        "_type": "blog",
        "_id": "3",
        "_score": 1,
        "_source": {
          "@timestamp": "2016-05-27T17:45:00",
          "message": "hi"
        }
      }
    ]
  }
}

但当我python -m elastalert.elastalert --verbose --rule example_frequency.yaml时，我明白了：

    INFO:elastalert:Starting up
    INFO:elastalert:Queried rule Example rule from 2016-05-27 17:43 IST to 2016-05-27 17:44 IST: 0 hits
    INFO:elastalert:Ran Example rule from 2016-05-27 17:43 IST to 2016-05-27 17:44 IST: 0 query hits, 0 matches, 0 alerts sent
    INFO:elastalert:Sleeping for 59 seconds
   INFO:elastalert:Queried rule Example rule from 2016-05-27 17:44 IST to 2016-05-27 17:45 IST: 0 hits
    INFO:elastalert:Ran Example rule from 2016-05-27 17:44 IST to 2016-05-27 17:45 IST: 0 query hits, 0 matches, 0 alerts sent
    INFO:elastalert:Sleeping for 59 seconds
  INFO:elastalert:Queried rule Example rule from 2016-05-27 17:45 IST to 2016-05-27 17:46 IST: 0 hits
    INFO:elastalert:Ran Example rule from 2016-05-27 17:45 IST to 2016-05-27 17:46 IST: 0 query hits, 0 matches, 0 alerts sent
    INFO:elastalert:Sleeping for 59 seconds
  INFO:elastalert:Queried rule Example rule from 2016-05-27 17:46 IST to 2016-05-27 17:47 IST: 0 hits
    INFO:elastalert:Ran Example rule from 2016-05-27 17:46 IST to 2016-05-27 17:47 IST: 0 query hits, 0 matches, 0 alerts sent
    INFO:elastalert:Sleeping for 59 seconds

为什么不起作用？它显示命中查询为0.但为什么我不理解。

Answer 1

使用“--es_debug_trace”可以在下面给出的示例中提供帮助

python -m elastalert.elastalert --verbose --rule example_frequency.yaml --es_debug_trace /opt/elastalert/runtime.log

这可以帮助您查看被触发的实际cURL命令以获取命中数。在这里，您可以查看用于搜索过滤器/查询/匹配的日期/时间范围。

在您的情况下，问题是@Val在评论中提到的日期（IST和UTC）。

Answer 2

您需要在规则中配置时间戳（example_rules / example_frequency.yaml）

timestamp_field: "@timestamp"

可能的：
timestamp_type
timestamp_format
- ＆GT; Documentation

除此之外，在您的情况下，您将获得这些配置的最佳性能：
use_count_query: true
doc_type: blog
- ＆GT; Documentation