Question

在我们的ES中，我们有一些我们定期搜索的索引的别名。其中一个索引包含我们的DNS日志。

如果我在Kibana或ES搜索：

查询：www.testbad.domain

无论我是在别名索引还是在DNS索引中搜索，我都可以获得点击。

所以我创建了以下规则：

# Test alert to check function

use_ssl: False

es_username: me
es_password: 12345

type: blacklist
    - "www.testbad.domain"
    - "!file /opt/elastalert/black_lists/bad_domains.txt"

index: alias-*

name: Detect-bad-domains

compare_key: Query

ignore_null: true

alert:
    - command

command: send_alert.sh

但是当我测试警报时，我得到以下信息：

 Successfully loaded Detect-bad-domains

 Got 12345325 hits from the last 1 day

 Available terms in first hit: <list of terms which does NOT include Query>

 Warning: compare key %s is either missing or null! 
 Included term Query may be missing or null

 Traceback (most recent call last):  
 File "/usr/bin/elastalert-test-rule", line 11 in <module>
 load_entry_point('elastalert==0.1.29', 'console_scripts','elastalert-test-rule')()  
 File "/usr/lib/python2.7/site-packages/elastalert-0.1.29.py2.7.egg/elastalert/test_rule.py", line 378, in main  
 test_instance.run_rule_test()  
 File "/usr/lib/python2.7/site-packages/elastalert-0.1.29.py2.7.egg/elastalert/test_rule.py", line 373, in run_rule_test  
 self.run_elastalert(rule_yaml, conf, args_
 File "/usr/lib/python2.7/site-packages/elastalert-0.1.29.py2.7.egg/elastalert/test_rule.py", line 211, in run_elastalert  
 load_modules(rule, load_modules_args) 
 File "/usr/lib/python2.7/site-packages/elastalert-0.1.29.py2.7.egg/elastalert/config.py", line 341, in load_modules  
 rule['type']=get_module(rule['type']) 
 File "/usr/lib/python2.7/site-packages/elastalert-0.1.29.py2.7.egg/elastalert/config.py", line 100, in get_module  
 base_module = __import__(module_path, globals(), locals(), [module_class])  
 elastalert.util.EAException:
 Could not import module blacklist: - "www.testbad.domain": No module named blacklist = "www.testbad

如果我从类型：blacklist下的列表中删除值www.testbad.domain，我会收到一个不同的回溯错误：

 Traceback (most recent call last): 
 File "/usr/bin/elastalert-test-rule", line 11 in <module>
 load_entry_point('elastalert==0.1.29', 'console_scripts','elastalert-test-rule')() 
 File "/usr/lib/python2.7/site-packages/elastalert-0.1.29.py2.7.egg/elastalert/test_rule.py", line 378, in main 
 test_instance.run_rule_test() 
 File "/usr/lib/python2.7/site-packages/elastalert-0.1.29.py2.7.egg/elastalert/test_rule.py", line 357, in run_rule_test 
 rule_yaml=load_rule_yaml(arg.file) 
 File "/usr/lib/python2.7/site-packages/elastalert-0.1.29.py2.7.egg/elastalert/config.py", line 128, in load_rule_yaml 
 loaded = yaml_loader(filename) 
 File "build/bdist.linux-x86_64/egg/staticconf/loader.py",line 93, in yaml_loader 
 File "/usr/lib64/python2.7/site-packages/yaml/__init__.py", line 71, in load return 
 loader.get_single_data() 
 File "/usr/lib64/python2.7/site-packages/yaml/constructor.py", line 37, in get_single_data 
 node = self.get_single_node() 
 File "/usr/lib64/python2.7/site-packages/yaml/composer.py", line 36, in get_single_node 
 document = self.compose_document() 
 File "/usr/lib64/python2.7/site-packages/yaml/composer.py", line 55, in compose_document 
 node = self.compose_document(None, None) 
 File "/usr/lib64/python2.7/site-packages/yaml/composer.py", line 84, in compose_node 
 node = self.compose_mapping_node(anchor) 
 File "/usr/lib64/python2.7/site-packages/yaml/composer.py", line 127, in compose_mapping_node 
 while not self.check_event(MappingEndEvent): 
 File "/usr/lib64/python2.7/site-packages/yaml/parser.py", line 98, in check_event 
 self.current_event = self.state() 
 File "/usr/lib64/python2.7/site-packages/yaml/parser.py", line 439, in parse_block_mapping_key 
 "expected <block end>, but found %r" % token.id, token.start_mark) 
 yaml.parser.ParserError: while parsing a block mapping 
 in "test-detect.yaml", line 3, column 1 
 expected <block end, but found '<block sequence start>' 
 in "test-detect.yaml", line 10, column 5

然后我尝试更改为输入任何内容并指定查询。

type: any

filter:
    - query:
        query_string:
            query: "Query: www.testbad.domain"

没有产生任何结果，但“查询”列在“首次点击中的可用条款”

中

所以我试过：查询：“查询：* www.testbad.domain *”。仍然没有命中。

然后我尝试了：查询：“查询：* testbad *”。现在我得到了点击。

（我无法让它显示正确，但两个查询都应该用没有空格的星号包围）

所以我的问题是这些：

黑名单搜索是怎么回事？为什么python出错？
当我在查询字符串的特定索引中搜索FQDN时，为什么不会受到影响？
为什么查询不会列为我可以使用别名搜索的字段？

Answer 1

Gaaah !!!语法，语法，语法。

type: blacklist
- "www.testbad.domain"
- "!file /opt/elastalert/black_lists/bad_domains.txt"

应该是：

type: blacklist

blacklist:
- "www.testbad.domain"
- "!file /opt/elastalert/black_lists/bad_domains.txt"

Elastalert黑名单警报给出追溯错误

1 个答案: