我的频率弹性系数规则没有匹配项

时间:2019-05-16 18:42:41

标签: elastic-stack elastalert

我正在elastalert中设置警报,因此每当用户使用sudo失败时都会收到警报。但是我写的任何规则都没有任何匹配,我也不知道我做错了什么。我尝试了多个黑名单和频率规则,但没有使它们起作用,也没有使用不同的索引,字符串和过滤器。这是我目前使用的规则。

规则yaml文件

es_host: elasticsearch
es_port: 9200

name: failed_sudo_warning

index: "*:logstash-beats-*"

type: frequency

num_events: 1

timeframe:
  minutes: 5

use_count_query: true
doc_type: 'doc'

filter:
- query:
   query_string:
     #query: "message: a"
     query: "message: user NOT in sudoers"

alert:
- debug

日志文件中的消息字段:

May 16 19:58:20 Cl-Ub sudo: virtlabsiem : user NOT in sudoers ; TTY=pts/0 ; PWD=/home/virtlabsiem ; USER=root ; COMMAND=/usr/bin/vim

索引字段:

- *:logstash-beats-*
- *:logstash-*

具有索引字段:logstash-beats-

的弹性测试输出
Please enter the file path and rule name you want to test.
/etc/elastalert/rules/failed_sudo_warning.yaml 
The results can be rather long.  Would you like to write the results to a file? (Y/N)
N
Successfully loaded failed_sudo_warning

INFO:elastalert:Queried rule failed_sudo_warning from 2019-05-16 18:33 UTC to 2019-05-16 18:34 UTC: 0 hits
INFO:elastalert:Queried rule failed_sudo_warning from 2019-05-16 18:34 UTC to 2019-05-16 18:35 UTC: 0 hits
INFO:elastalert:Queried rule failed_sudo_warning from 2019-05-16 18:35 UTC to 2019-05-16 18:36 UTC: 0 hits
INFO:elastalert:Queried rule failed_sudo_warning from 2019-05-16 18:36 UTC to 2019-05-16 18:37 UTC: 0 hits
INFO:elastalert:Queried rule failed_sudo_warning from 2019-05-16 18:37 UTC to 2019-05-16 18:38 UTC: 0 hits
INFO:elastalert:Queried rule failed_sudo_warning from 2019-05-16 18:38 UTC to 2019-05-16 18:38 UTC: 0 hits

Would have written the following documents to writeback index (default is elastalert_status):

elastalert_status - {'hits': 0, 'matches': 0, '@timestamp': datetime.datetime(2019, 5, 16, 18, 38, 4, 319317, tzinfo=tzutc()), 'rule_name': 'failed_sudo_warning', 'starttime': datetime.datetime(2019, 5, 16, 18, 33, 1, 284936, tzinfo=tzutc()), 'endtime': datetime.datetime(2019, 5, 16, 18, 38, 4, 284936, tzinfo=tzutc()), 'time_taken': 0.029651165008544922}

Complete!

具有索引字段:logstash-

的弹性测试输出
Successfully loaded failed_sudo_warning

INFO:elastalert:Queried rule failed_sudo_warning from 2019-05-16 18:33 UTC to 2019-05-16 18:34 UTC: 24 hits
INFO:elastalert:Queried rule failed_sudo_warning from 2019-05-16 18:34 UTC to 2019-05-16 18:35 UTC: 36 hits
INFO:elastalert:Queried rule failed_sudo_warning from 2019-05-16 18:35 UTC to 2019-05-16 18:36 UTC: 20 hits
INFO:elastalert:Queried rule failed_sudo_warning from 2019-05-16 18:36 UTC to 2019-05-16 18:37 UTC: 29 hits
INFO:elastalert:Queried rule failed_sudo_warning from 2019-05-16 18:37 UTC to 2019-05-16 18:38 UTC: 79 hits
INFO:elastalert:Queried rule failed_sudo_warning from 2019-05-16 18:38 UTC to 2019-05-16 18:38 UTC: 0 hits
INFO:elastalert:Alert for failed_sudo_warning at 2019-05-16T18:34:53.757004Z:
INFO:elastalert:failed_sudo_warning

At least 1 events occurred between 2019-05-16 18:29 UTC and 2019-05-16 18:34 UTC

@timestamp: 2019-05-16T18:34:53.757004Z
num_hits: 188
num_matches: 5

INFO:elastalert:Ignoring match for silenced rule failed_sudo_warning
INFO:elastalert:Ignoring match for silenced rule failed_sudo_warning
INFO:elastalert:Ignoring match for silenced rule failed_sudo_warning
INFO:elastalert:Ignoring match for silenced rule failed_sudo_warning

Would have written the following documents to writeback index (default is elastalert_status):

silence - {'rule_name': 'failed_sudo_warning', '@timestamp': datetime.datetime(2019, 5, 16, 18, 38, 56, 865075, tzinfo=tzutc()), 'exponent': 0, 'until': datetime.datetime(2019, 5, 16, 18, 39, 56, 865067, tzinfo=tzutc())}

elastalert_status - {'hits': 188, 'matches': 5, '@timestamp': datetime.datetime(2019, 5, 16, 18, 38, 56, 866752, tzinfo=tzutc()), 'rule_name': 'failed_sudo_warning', 'starttime': datetime.datetime(2019, 5, 16, 18, 33, 53, 757004, tzinfo=tzutc()), 'endtime': datetime.datetime(2019, 5, 16, 18, 38, 56, 757004, tzinfo=tzutc()), 'time_taken': 0.10465812683105469}

Complete!

我希望我需要使用beats索引,而不仅仅是logstash索引,因为日志已发送到该索引。如果我打开logstash-beats索引,我会在其中看到日志,但它们也会出现在logstash-index中。希望有人可以帮助我。

0 个答案:

没有答案