Question

我正在努力使用elastalert来提醒获取特定性质或频率的数据。请参阅我的弹性规则.yaml文件。

            # Alert when the rate of events exceeds a threshold

            # (Optional)
            # Elasticsearch host
            es_host: localhost

            # (Optional)
            # Elasticsearch port
            es_port: 9200

            # (OptionaL) Connect with SSL to Elasticsearch
            #use_ssl: True

            # (Optional) basic-auth username and password for Elasticsearch
            #es_username: someusername
            #es_password: somepassword

            # (Required)
            # Rule name, must be unique
            name: my_rule

            # (Required)
            # Type of alert.
            # the frequency rule type alerts when num_events events occur with timeframe time
            type: any
            #frequency

            # (Required)
            # Index to search, wildcard supported
            index: shakes*

            # (Required, frequency specific)
            # Alert when this many documents matching the query occur within a timeframe
            num_events: 1

            # (Required, frequency specific)
            # num_events must occur within this amount of time to trigger an alert
            timeframe:
              seconds: 15

            # (Required)
            # A list of Elasticsearch filters used for find events
            # These filters are joined with AND and nested in a filtered query
            # For more info: http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl.html
            filter: []
            #- query:
            #   query_string: 
            #      query: "play_name: Henry IV"

            # (Required)
            # The alert is use when a match is found
            alert:
            - "email"

            # (required, email specific)
            # a list of email addresses to send alerts to
            email:
            - "olawi@vg.com"

点击量应该算上。我没有点击。现在，我看到了一个类似的帖子，其中dev被要求调整时间，因为elastalert根据浏览器的时间工作。我调整了系统时间以匹配索引中文档的时间戳，但仍然没有给出该时间段的任何命中。

感谢。

Answer 1

Elastic Search，Kibana和ELastAlert默认在UTC上工作。因此，ElastAlert将查询您的ES基础UTC。请您遵循以下几点。

请检查您的kibana是哪个时区使用（因为您正在使用Kibana来检查匹配数）。你可以这样做 “管理”标签->“高级设置”-> dateFormat：tz 。如果不是UTC，请将其更改为UTC，然后与ElastAlert进行比较。这个如果有的话，它将为您带来成功。（假设您还没有在您的ES模式中指定了其他时区。完成后，更换Kibana 时区与ES的时区进行比较）
如果您的ES中的时区不同于UTC，请遵循this issue寻求解决方案。
此外，您还可以检查ElastAlert用于生成的ES查询确定要查询的日期时间过滤器。你可以这样通过更改ElastAlert的日志记录级别。请遵循this来这样做。

谢谢

Elastalert没有阅读命中

1 个答案: