我按照以下设置了我的 ElastAlert 规则。
MyRangeAlert.yaml: |-
---
name: MyRangeAlert
type: frequency
limit_execution: "0/8 * * * *"
index: myindex-*
num_events: 1
timeframe:
minutes: 15
filter:
- query:
query_string:
query: "request.keyword: \"\/api\/rest\/cms\/content\/cited-by\/\" AND response:503"
- range:
field3:
from: 150
to: 200
alert:
- "email"
email:
- "johndoe@gmail.com"
from_addr: "margert@gmail.com"
alert_subject: " High Response Time at {0}."
alert_subject_args:
- "@timestamp"
alert_text: "Average response {0} seconds observed in last 20 minutes."
alert_text_args:
- field3
alert_text_type: alert_text_only
然后我插入数据来满足条件。
PUT MyRangeAlert/_doc/501
{
"request.keyword": "/api/rest/cms/content/cited-by/",
"response": 503,
"tags": "account_compromised",
"alert-triggered": true,
"field3": 156,
"city": "Kansas",
"name": "sameera",
"description": "desccrption 1032",
"@timestamp": "2021-01-06T11:31:23+0000"
}
不过。警报未发送电子邮件。我删除了范围然后它开始发送警报。 任何建议或半答案也非常感谢。
答案 0 :(得分:0)
在 field3 前面添加一个空格后出现缩进错误。
filter:
- query:
query_string:
query: "request.keyword: \"\/api\/rest\/cms\/content\/cited-by\/\" AND response:503"
- range:
field3:
from: 150
to: 200