使用汇总表字段时未显示时间戳

时间:2019-01-11 05:30:53

标签: elasticsearch elastalert

以下是我对elastalert的配置。

es_host: xx.xx.xx.xx
es_port: 9200
name: file-creation-alert
type: frequency
index: auditbeat-6.4.0-2019*
filter:
  - term:
       file.type: file
  - term:
       event.action: created
include:
  - @timestamp
  - beat.hostname
  - event.action
  - file.owner

summary_table_fields:
  - @timestamp
  - beat.hostname
  - event.action
  - file.path
  - file.type

num_events: 1
timeframe:
    hours: 1
alert:
- "slack"
slack:
slack_webhook_url: "https://hooks.slack.com/services/xxx/xxxxx/xxxx"

现在在Summary_Table_fields中,我给了@timestamp。但这不会显示在生成的表中。 您可以看到下面创建的示例表:

sample table created by Elastalert, no @timestamp field seen

0 个答案:

没有答案