以下是我对elastalert的配置。
es_host: xx.xx.xx.xx
es_port: 9200
name: file-creation-alert
type: frequency
index: auditbeat-6.4.0-2019*
filter:
- term:
file.type: file
- term:
event.action: created
include:
- @timestamp
- beat.hostname
- event.action
- file.owner
summary_table_fields:
- @timestamp
- beat.hostname
- event.action
- file.path
- file.type
num_events: 1
timeframe:
hours: 1
alert:
- "slack"
slack:
slack_webhook_url: "https://hooks.slack.com/services/xxx/xxxxx/xxxx"
现在在Summary_Table_fields中,我给了@timestamp。但这不会显示在生成的表中。 您可以看到下面创建的示例表: