Question

我正在尝试使用Elastalert的简单规则，它似乎无法正常运行。我的规则是：

ArrayEx

我的config.yaml

name: termrule
 type: Any
 index: logstash-*
fields:
- "ip"
filter:
- term:
 _type: "log"
- term:
   agentip: 1.2.3.4
  alert:
 email:
- "myemail@company.com "

 ##remote mailserver
smtp_host:
- "remote mailserver_ip"

调试日志：

es_host: 1.2.3.4
es_port: 9200
rules_folder: rules
run_every:
minutes: 1
buffer_time:
 minutes: 15
writeback_index: elastalert_status
alert_time_limit:
days: 2
es_conn_timeout: 20

但是当我使用命令

运行时

INFO:elastalert:Note: In debug mode, alerts will be logged to console but NOT actually sent. To send them, use --verbose.
Traceback (most recent call last):
File "/usr/lib/python2.7/runpy.py", line 162, in _run_module_as_main
"__main__", fname, loader, pkg_name)
 File "/usr/lib/python2.7/runpy.py", line 72, in _run_code
exec code in run_globals
 File "/home/george/elastalert/elastalert/elastalert.py", line 1408, in       <module>
sys.exit(main(sys.argv[1:]))
File "/home/george/elastalert/elastalert/elastalert.py", line 1403, in main
client = ElastAlerter(args)
File "/home/george/elastalert/elastalert/elastalert.py", line 94, in __init__
self.conf = load_rules(self.args)
File "elastalert/config.py", line 400, in load_rules
raise EAException('Error loading file %s: %s' % (rule_file, e))
elastalert.util.EAException: Error loading file ./rules/term_rule.yaml:  Invalid Rule: termrule
{'index': 'logstash-*', 'name': 'termrule', 'fields': ['agentip'], 'smtp_host': ['X.X.X.X'], 'alert': ['email'], 'filter': [{'term': {'_type': 'log'}}, {'term': {'agentip': '1.2.3.4'}}], 'rule_file': './rules/term_rule.yaml', 'type': 'Any', 'email': ['myemail@company.com']} is not valid under any of the given schemas

我刚刚运行了Kibana查询以验证我的过滤器返回了5次点击但我的elastalert.log为空我没有收到任何提醒电子邮件，如果规则是＆＃39;任何＆＃39;然后应该提醒任何查询命中，但正如你所看到的那样。有什么想法吗？

非常感谢任何帮助。感谢

Answer 1

YAML对白色空间敏感。我不确定复制和粘贴是否出错但有些字段看起来不对齐：

  alert:
 email:
- "myemail@company.com

我会改为

alert:
- "email"
email:
- "myemail@company.com"

你也有

smtp_host:
- "remote mailserver_ip"

在输出错误消息中将其转换为数组。我不认为您可以拥有SMTP中继列表，因此它可能与可以处理它的模式不匹配。尝试将其更改为

smtp_host: "remote mailserver_ip"

Elastalert没有通过电子邮件提醒？

1 个答案: