Question

我在elastalert中有一条规则，如果两小时内没有付款，则发送通知。我还有一个匹配增强功能，可以在每天晚上0:00到8:00之间删除这些通知：

services.AddDbContext<YourApplicationDbContext>(options =>
                options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection")));

services.AddIdentity<YourApplicationUser, IdentityRole>()
                .AddEntityFrameworkStores<YourApplicationDbContext>()
                .AddDefaultTokenProviders();

但是现在我想在星期天早上（当人们大多数时间睡觉时）添加一个“放松”，并在0:00到10:00 AM之间提出DropMatchException。我怎么能这样做？

Answer 1

解决方案是：

from elastalert.enhancements import BaseEnhancement, DropMatchException
import datetime
import time
import sys

def datetime_from_utc_to_local(utc_datetime):
    now_timestamp = time.time()
    offset = datetime.datetime.fromtimestamp(now_timestamp) - datetime.datetime.utcfromtimestamp(now_timestamp)
    return utc_datetime + offset

class DropFrom00To06(BaseEnhancement):
    def process(self, match):
        dateformat = "%Y-%m-%dT%H:%M:%S"
        exceptional_dateformat = "%Y-%m-%dT%H:%M:%SZ"
        timestamp = match['@timestamp'].split(".")[0]
        try:
            timestamp = datetime.datetime.strptime(timestamp, dateformat)
        except ValueError:
            timestamp = datetime.datetime.strptime(timestamp, exceptional_dateformat)
        except:
            print("Unexpected error:", sys.exc_info()[0])
            raise
        timestamp = datetime_from_utc_to_local(timestamp)
        timePart = timestamp.time()
        d = timestamp.date()
        day = d.weekday()
        elif day == 6 and timePart >= datetime.time(00, 00) and timePart <= datetime.time(10, 00):
            raise DropMatchException()
        elif timePart >= datetime.time(00, 00) and timePart <= datetime.time(8, 00):
            raise DropMatchException()

由于误报，周日早上放松弹性

1 个答案: