Question

我正在研究Kibana 6x，并使用SentiNL生成电子邮件警报。如果我的应用程序生成日志“阈值未定义凭据未定义凭据”，则下面是我生成邮件的查询。当我玩观察器时，出现以下错误。

错误：Watchers: play watcher : execute watcher : execute advanced watcher : get elasticsearch payload : search : [parsing_exception] [match] malformed query, expected [END_OBJECT] but found [FIELD_NAME], with { line=1 & col=80 }

查询：

"input": {
    "search": {
      "request": {
        "index": [
          "filebeat-2019.03.21"
        ],
        "body": {
          "query": {
            "match": {
              "msg": "CREDENTIALS ARE NOT DEFINED FOR PULL EVENT SOURCES"
            },
            "minimum_number_should_match": 1,
            "bool": {
              "filter": {
                "range": {
                  "@timestamp": {
                    "gte": "now-15m/m",
                    "lte": "now/m",
                    "format": "epoch_millis"
                  }
                }
              }
            }
          },
          "size": 0,
          "aggs": {
            "dateAgg": {
              "date_histogram": {
                "field": "@timestamp",
                "time_zone": "Europe/Amsterdam",
                "interval": "1m",
                "min_doc_count": 1
              }
            }
          }
        }
      }
    }
  }

我还使用了“ minimum_number_should_match”来跟踪阈值。正确吗？

Answer 1

找到解决方案（这里我还没有添加阈值）：

{
"actions": {
    "email_html_alarm_2daee075-0f24-408e-a362-59172b5e3a1d": {
        "name": "email html alarm",
        "throttle_period": "1m",
        "email_html": {
            "stateless": false,
            "subject": "Error v1.9 conditon",
            "priority": "high",
            "html": "<p>{{payload.hits.hits}} test hits Hi {{watcher.username}}</p>\n<p>There are {{payload.hits.total}} results found by the watcher <i>{{watcher.title}}</i>.</p>\n\n<div style=\"color:grey;\">\n  <hr />\n  <p>This watcher sends alerts based on the following criteria:</p>\n  <ul><li>{{watcher.wizard.chart_query_params.queryType}} of {{watcher.wizard.chart_query_params.over.type}} over the last {{watcher.wizard.chart_query_params.last.n}} {{watcher.wizard.chart_query_params.last.unit}} {{watcher.wizard.chart_query_params.threshold.direction}} {{watcher.wizard.chart_query_params.threshold.n}} in index {{watcher.wizard.chart_query_params.index}}</li></ul>\n</div>",
            "to": "abc@qwe.com",
            "from": "abc@qwe.com"
        }
    }
},
"input": {
    "search": {
        "request": {
            "index": [
                "file-2019.04.03"
            ],
            "body": {
                "query": {
                    "bool": {
                        "must": {
                            "query_string": {
                                "query": "CREDENTIALS ARE NOT FOUND",
                                "analyze_wildcard": true,
                                "default_field": "*"
                            }
                        },
                        "filter": [{
                            "range": {
                                "@timestamp": {
                                    "gte": "now-1d",
                                    "lte": "now/m",
                                    "format": "epoch_millis"
                                }
                            }
                        }]
                    }
                }
            }
        }
    }
},
"condition": {
    "script": {
        "script": "payload.hits.total > 0"
    }
},
"trigger": {
    "schedule": {
        "later": "every 2 minutes"
    }
},
"disable": true,
"report": false,
"title": "watcher_title",
"save_payload": false,
"spy": false,
"impersonate": false

}

在Kibana中获得“预期[END_OBJECT]但找到了[FIELD_NAME]”

1 个答案: