{"id":1064,"date":"2023-03-21T17:29:01","date_gmt":"2023-03-21T09:29:01","guid":{"rendered":"https:\/\/ext4.cn\/?p=1064"},"modified":"2024-06-26T15:09:50","modified_gmt":"2024-06-26T07:09:50","slug":"elastalert2-alert","status":"publish","type":"post","link":"https:\/\/ext4.cn\/?p=1064","title":{"rendered":"ElastAlert2+ELK\u9489\u9489\u544a\u8b66"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">\u524d\u8a00<\/h2>\n\n\n\n<p>\u73b0\u5728\u516c\u53f8\u7528\u7684\u662fELK\u65e5\u5fd7\u67b6\u6784\u505a\u65e5\u5fd7\u6536\u96c6\u548c\u5c55\u793a\u5206\u6790\uff0c\u6240\u4ee5\u76f8\u5bf9\u4e00\u4e9b\u65e5\u5fd7\u8fdb\u884c\u5173\u952e\u5b57\u8fdb\u884c\u544a\u8b66\uff0c\u6bd4\u5982MQTT\u3001Nginx40X\u548c50X\u72b6\u6001\u8bf7\u6c42\u3001\u540e\u7aef\u670d\u52a1ERROR\u4e25\u91cd\u9519\u8bef\u65e5\u5fd7\uff0c\u901a\u8fc7\u76d1\u63a7ES\u65e5\u5fd7\u6570\u636e\uff0c\u7136\u540e\u4f7f\u7528Python\u8c03\u7528\u9489\u9489\u63a5\u53e3\u6765\u5b9e\u73b0\u65e5\u5fd7\u544a\u8b66<\/p>\n\n\n\n<ul>\n<li>5.0\u7248\u672c\u4e4b\u540eElastic\u5c06\u4e00\u4e9b\u91cd\u8981\u7684\u63d2\u4ef6\u6574\u5408\u6210\u4e86X-Pack\uff08\u9700\u8981\u6536\u8d39\uff09<\/li>\n\n\n\n<li>\u6240\u4ee5\u4f7f\u7528\u5f00\u6e90\u7684ElastAlert<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">ElastAlert2<\/h2>\n\n\n\n<p>1\u3001ElastAlert\u662fYelp \u516c\u53f8\u5f00\u6e90\u7684\u4e00\u5957\u7528 Python\u5199\u7684\u62a5\u8b66\u6846\u67b6\u3002\u5c5e\u4e8e\u540e\u6765 Elastic.co \u516c\u53f8\u51fa\u54c1\u7684 Watcher \u540c\u7c7b\u4ea7\u54c1\u3002ElastAlert2\u662f\u539f\u59cbYelp\/elasteralert\u9879\u76ee\u7684\u5ef6\u7eed\uff5e<\/p>\n\n\n\n<ul>\n<li>\u5b98\u7f51\u5730\u5740\uff1a<a href=\"https:\/\/elastalert2.readthedocs.io\/\">https:\/\/elastalert2.readthedocs.io\/<\/a><\/li>\n<\/ul>\n\n\n\n<ul>\n<li>github\u5730\u5740\uff1a<a href=\"https:\/\/github.com\/jertel\/elastalert2\">https:\/\/github.com\/jertel\/elastalert2<\/a><\/li>\n<\/ul>\n\n\n\n<p>2\u3001\u5b83\u652f\u6301\u591a\u79cd\u76d1\u63a7\u6a21\u5f0f\u548c\u544a\u8b66\u65b9\u5f0f<\/p>\n\n\n\n<ul>\n<li>\u7535\u5b50\u90ae\u4ef6\uff1a\u901a\u8fc7\u7535\u5b50\u90ae\u4ef6\u53d1\u9001\u62a5\u8b66<\/li>\n\n\n\n<li>Slack\uff1a\u5c06\u62a5\u8b66\u53d1\u9001\u5230Slack\u901a\u9053<\/li>\n\n\n\n<li>Microsoft Teams\uff1a\u5c06\u62a5\u8b66\u53d1\u9001\u5230Microsoft Teams\u9891\u9053<\/li>\n\n\n\n<li>JIRA\uff1a\u5728JIRA\u4e0a\u521b\u5efa\u95ee\u9898<\/li>\n\n\n\n<li>\u5bfb\u547c\u673a\u804c\u8d23\uff1a\u901a\u8fc7\u5bfb\u547c\u673a<\/li>\n\n\n\n<li>Amazon SNS\uff1a\u5c06\u62a5\u8b66\u53d1\u9001\u5230 Amazon Simple Notification Service\uff08SNS\uff09\u4e3b\u9898<\/li>\n\n\n\n<li>Webhook\uff1a\u901a\u8fc7\u81ea\u5b9a\u4e49HTTP POST\u8bf7\u6c42\u53d1\u9001\u62a5\u8b66<\/li>\n\n\n\n<li>Telegram\uff1a\u5c06\u62a5\u8b66\u53d1\u9001\u5230Telegram\u7fa4\u7ec4\u6216\u7528\u6237<\/li>\n\n\n\n<li>Google Chat\uff1a\u5c06\u62a5\u8b66\u53d1\u9001\u5230Google Chat\u623f\u95f4<\/li>\n\n\n\n<li>Twilio\uff1a\u901a\u8fc7\u7535\u8bdd\u6216\u77ed\u4fe1\u53d1\u9001\u62a5\u8b66<\/li>\n\n\n\n<li>Alerta\uff1a\u5c06\u62a5\u8b66\u53d1\u9001\u5230Alerta API<\/li>\n\n\n\n<li>Datadog\uff1a\u5c06\u62a5\u8b66\u53d1\u9001\u5230Datadog\u4e8b\u4ef6\u6d41<\/li>\n\n\n\n<li>Gitter\uff1a\u5c06\u62a5\u8b66\u53d1\u9001\u5230Gitter\u804a\u5929\u5ba4<\/li>\n\n\n\n<li>VictorOps\uff1a\u901a\u8fc7VictorOps\u89e6\u53d1\u62a5\u8b66<\/li>\n<\/ul>\n\n\n\n<p>3\u3001\u4f46\u662f\u5e76\u4e0d\u652f\u6301\u9489\u9489\u544a\u8b66\uff0c\u5728github\u4e0a\u9762\u6709\u7b2c\u4e09\u65b9\u7684\u9489\u9489Python\u9879\u76ee\uff1a<a href=\"https:\/\/github.com\/xuyaoqiang\/elastalert-dingtalk-plugin\">https:\/\/github.com\/xuyaoqiang\/elastalert-dingtalk-plugin<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u6700\u7ec8\u6548\u679c\u56fe<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">\u540e\u7aefservice<\/h3>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/ext4.cn\/wp-content\/uploads\/2023\/03\/image.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/ext4.cn\/wp-content\/uploads\/2023\/03\/image.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"\/><\/div><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">\u524d\u7aefweb<\/h3>\n\n\n\n<ul>\n<li>Bytespider\u5b57\u8282\u8df3\u52a8\u65d7\u4e0b\u7684\u4eca\u65e5\u5934\u6761\u722c\u866b\u3002\u3002\u3002<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">\u90e8\u7f72<\/h2>\n\n\n\n<p>1\u3001\u5148\u51c6\u5907\u9489\u9489\u673a\u5668\u4eba<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/ext4.cn\/wp-content\/uploads\/2023\/03\/image-2.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/ext4.cn\/wp-content\/uploads\/2023\/03\/image-2.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"\/><\/div><\/figure>\n\n\n\n<ul>\n<li>\u590d\u5236webhook<\/li>\n<\/ul>\n\n\n\n<p>2\u3001\u4eceGitHub\u4e0a\u514b\u9686elastalert2\u9879\u76ee<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>git clone https:\/\/github.com\/jertel\/elastalert2.git\ncd elastalert2<\/code><\/pre>\n\n\n\n<div class=\"wp-block-file\"><a id=\"wp-block-file--media-214e09f2-58f6-4582-93b0-19af4f787181\" href=\"http:\/\/ext4.cn\/wp-content\/uploads\/2023\/03\/elastalert2.zip\">elastalert2<\/a><a href=\"http:\/\/ext4.cn\/wp-content\/uploads\/2023\/03\/elastalert2.zip\" class=\"wp-block-file__button wp-element-button\" download aria-describedby=\"wp-block-file--media-214e09f2-58f6-4582-93b0-19af4f787181\"><\/a><\/div>\n\n\n\n<p>3\u3001\u514b\u9686\u9489\u9489\u544a\u8b66\u63d2\u4ef6\u9879\u76ee<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>git clone https:\/\/github.com\/xuyaoqiang\/elastalert-dingtalk-plugin.git<\/code><\/pre>\n\n\n\n<div class=\"wp-block-file\"><a id=\"wp-block-file--media-6f83b8ce-67a4-4b92-93e0-b177d355fc62\" href=\"https:\/\/ext4.cn\/2023\/03\/elastalert-dingtalk-plugin.zip\">elastalert-dingtalk-plugin<\/a><a href=\"https:\/\/ext4.cn\/2023\/03\/elastalert-dingtalk-plugin.zip\" class=\"wp-block-file__button wp-element-button\" download aria-describedby=\"wp-block-file--media-6f83b8ce-67a4-4b92-93e0-b177d355fc62\">\u4e0b\u8f7d<\/a><\/div>\n\n\n\n<p>4\u3001\u521b\u5efa\u4e00\u4e2aconfig.yaml\u6587\u4ef6\u5728Elastalert2\u9879\u76ee\u7684\u6839\u76ee\u5f55<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>es_host: 10.10.10.179\nes_port: 9200\nrules_folder: rules  # ElastAlert2\u7684\u89c4\u5219\u6587\u4ef6\u5939\u8def\u5f84\nrun_every:  # ElastAlert2\u68c0\u67e5\u65b0\u8b66\u62a5\u7684\u9891\u7387\n  minutes: 1\nbuffer_time:  # \u7f13\u51b2\u65f6\u95f4\uff0c\u7528\u4e8e\u62c9\u53d6\u5386\u53f2\u6570\u636e\n  minutes: 15\nwriteback_index: elastalert_status  # \u5b58\u50a8\u8b66\u62a5\u72b6\u6001\u7684\u7d22\u5f15\u540d\u79f0\nalert_time_limit:  # \u8b66\u62a5\u7684\u8fc7\u671f\u65f6\u95f4\n  days: 2<\/code><\/pre>\n\n\n\n<p>5\u3001\u5c06\u9489\u9489\u544a\u8b66\u63d2\u4ef6\u590d\u5236\u5230Elastalert2\u9879\u76ee\u7684<code>elastalert<\/code>\u76ee\u5f55<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cp elastalert-dingtalk-plugin\/elastalert_modules\/dingtalk_alert.py elastalert2\/elastalert\/<\/code><\/pre>\n\n\n\n<p>6\u3001\u5728Elastalert2\u9879\u76ee\u6839\u76ee\u5f55\u4e0b\u521b\u5efa<code>rules<\/code>\u76ee\u5f55<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>mkdir rules<\/code><\/pre>\n\n\n\n<p>7\u3001\u521b\u5efa\u4e00\u4e2a\u540d\u4e3a<code>example_rule.yaml<\/code>\u7684\u89c4\u5219\u6587\u4ef6\uff0c\u5e76\u6dfb\u52a0\u4ee5\u4e0b\u5185\u5bb9\u3002\u8bf7\u52a1\u5fc5\u66ff\u6362<code>&lt;your_dingtalk_webhook&gt;<\/code>\u4e3a\u60a8\u7684\u9489\u9489webhook\u5730\u5740<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>name: Example rule\ntype: any\nindex: logstash-*\nnum_events: 50\ntimeframe:\n  hours: 4\nfilter:\n- term:\n    some_field: \"some_value\"\nalert:\n- \"elastalert.dingtalk_alert.DingTalkAlerter\"\ndingtalk_webhook: '&lt;your_dingtalk_webhook&gt;'\ndingtalk_msgtype: 'text'<\/code><\/pre>\n\n\n\n<p>8\u3001\u4fee\u6539Dockerfile<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>FROM python:3-slim-buster as builder\nLABEL description=\"ElastAlert 2 Official Image\"\nLABEL maintainer=\"Jason Ertel\"\nCOPY . \/tmp\/elastalert\nRUN mkdir -p \/opt\/elastalert &amp;&amp; \\\n    cd \/tmp\/elastalert &amp;&amp; \\\n    pip install setuptools wheel &amp;&amp; \\\n    python setup.py sdist bdist_wheel\nFROM python:3-slim-buster\nARG GID=1000\nARG UID=1000\nARG USERNAME=elastalert\nCOPY --from=builder \/tmp\/elastalert\/dist\/*.tar.gz \/tmp\/\nCOPY elastalert\/dingtalk_alert.py \/opt\/elastalert\/elastalert\/\nRUN pip install requests -i https:\/\/mirrors.aliyun.com\/pypi\/simple\/\nCOPY requirements.txt \/tmp\/\nRUN pip install --no-cache-dir -r \/tmp\/requirements.txt -i https:\/\/mirrors.aliyun.com\/pypi\/simple\/\nRUN apt update &amp;&amp; apt -y upgrade &amp;&amp; \\\n    apt -y install jq curl gcc libffi-dev &amp;&amp; \\\n    rm -rf \/var\/lib\/apt\/lists\/* &amp;&amp; \\\n    pip install \/tmp\/*.tar.gz &amp;&amp; \\\n    rm -rf \/tmp\/* &amp;&amp; \\\n    apt -y remove gcc libffi-dev &amp;&amp; \\\n    apt -y autoremove &amp;&amp; \\\n    mkdir -p \/opt\/elastalert &amp;&amp; \\\n    echo \"#!\/bin\/sh\" &gt;&gt; \/opt\/elastalert\/run.sh &amp;&amp; \\\n    echo \"set -e\" &gt;&gt; \/opt\/elastalert\/run.sh &amp;&amp; \\\n    echo \"elastalert-create-index --config \/opt\/elastalert\/config.yaml\" \\\n        &gt;&gt; \/opt\/elastalert\/run.sh &amp;&amp; \\\n    echo \"elastalert --config \/opt\/elastalert\/config.yaml \\\"\\$@\\\"\" \\\n        &gt;&gt; \/opt\/elastalert\/run.sh &amp;&amp; \\\n    chmod +x \/opt\/elastalert\/run.sh &amp;&amp; \\\n    groupadd -g ${GID} ${USERNAME} &amp;&amp; \\\n    useradd -u ${UID} -g ${GID} -M -b \/opt -s \/sbin\/nologin \\\n        -c \"ElastAlert 2 User\" ${USERNAME}\nUSER ${USERNAME}\nENV TZ \"UTC\"\nWORKDIR \/opt\/elastalert\nENTRYPOINT &#91;\"\/opt\/elastalert\/run.sh\"]<\/code><\/pre>\n\n\n\n<p>9\u3001\u66f4\u6362\u4e3a\u963f\u91cc\u6e90<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>FROM python:3-slim-buster as builder\nLABEL description=\"ElastAlert 2 Official Image\"\nLABEL maintainer=\"Jason Ertel\"\nCOPY . \/tmp\/elastalert\nRUN mkdir -p \/opt\/elastalert &amp;&amp; \\\n    cd \/tmp\/elastalert &amp;&amp; \\\n    pip install setuptools wheel &amp;&amp; \\\n    python setup.py sdist bdist_wheel\nFROM python:3-slim-buster\nARG GID=1000\nARG UID=1000\nARG USERNAME=elastalert\nCOPY --from=builder \/tmp\/elastalert\/dist\/*.tar.gz \/tmp\/\nCOPY elastalert\/dingtalk_alert.py \/opt\/elastalert\/elastalert\/\nRUN pip install requests -i https:\/\/mirrors.aliyun.com\/pypi\/simple\/\nCOPY requirements.txt \/tmp\/\nRUN pip install --no-cache-dir -r \/tmp\/requirements.txt -i https:\/\/mirrors.aliyun.com\/pypi\/simple\/\nRUN echo 'deb http:\/\/mirrors.aliyun.com\/debian\/ buster main non-free contrib\\n\\\ndeb-src http:\/\/mirrors.aliyun.com\/debian\/ buster main non-free contrib\\n\\\ndeb http:\/\/mirrors.aliyun.com\/debian-security buster\/updates main\\n\\\ndeb-src http:\/\/mirrors.aliyun.com\/debian-security buster\/updates main\\n\\\ndeb http:\/\/mirrors.aliyun.com\/debian\/ buster-updates main non-free contrib\\n\\\ndeb-src http:\/\/mirrors.aliyun.com\/debian\/ buster-updates main non-free contrib\\n\\\ndeb http:\/\/mirrors.aliyun.com\/debian\/ buster-backports main non-free contrib\\n\\\ndeb-src http:\/\/mirrors.aliyun.com\/debian\/ buster-backports main non-free contrib' &gt; \/etc\/apt\/sources.list &amp;&amp; \\\n    apt update &amp;&amp; apt -y upgrade &amp;&amp; \\\n    apt -y install jq curl gcc libffi-dev &amp;&amp; \\\n    rm -rf \/var\/lib\/apt\/lists\/* &amp;&amp; \\\n    pip install \/tmp\/*.tar.gz &amp;&amp; \\\n    rm -rf \/tmp\/* &amp;&amp; \\\n    apt -y remove gcc libffi-dev &amp;&amp; \\\n    apt -y autoremove &amp;&amp; \\\n    mkdir -p \/opt\/elastalert &amp;&amp; \\\n    echo \"#!\/bin\/sh\" &gt;&gt; \/opt\/elastalert\/run.sh &amp;&amp; \\\n    echo \"set -e\" &gt;&gt; \/opt\/elastalert\/run.sh &amp;&amp; \\\n    echo \"elastalert-create-index --config \/opt\/elastalert\/config.yaml\" \\\n        &gt;&gt; \/opt\/elastalert\/run.sh &amp;&amp; \\\n    echo \"elastalert --config \/opt\/elastalert\/config.yaml \\\"\\$@\\\"\" \\\n        &gt;&gt; \/opt\/elastalert\/run.sh &amp;&amp; \\\n    chmod +x \/opt\/elastalert\/run.sh &amp;&amp; \\\n    groupadd -g ${GID} ${USERNAME} &amp;&amp; \\\n    useradd -u ${UID} -g ${GID} -M -b \/opt -s \/sbin\/nologin \\\n        -c \"ElastAlert 2 User\" ${USERNAME}\nUSER ${USERNAME}\nENV TZ \"UTC\"\nWORKDIR \/opt\/elastalert\nENTRYPOINT &#91;\"\/opt\/elastalert\/run.sh\"]<\/code><\/pre>\n\n\n\n<p>10\u3001\u4f7f\u7528Docker\u6784\u5efaElastalert2\u955c\u50cf<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>docker build -t elastalert2 .<\/code><\/pre>\n\n\n\n<p>11\u3001\u4f7f\u7528Docker\u8fd0\u884cElastalert2\u5bb9\u5668<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>docker run -d --name elastalert2 -v $(pwd)\/config.yaml:\/opt\/elastalert\/config.yaml -v $(pwd)\/rules:\/opt\/elastalert\/rules elastalert2<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">\u4fee\u6539rules\u683c\u5f0f<\/h2>\n\n\n\n<p>1\u3001service\u540e\u7aefrules<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>name: \"prd-service-***\"\ntype: \"frequency\"\nindex: \"prd-service-*\"\nis_enabled: true\nnum_events: 1\ntimeframe:\n  minutes: 1\nrealert:\n  minutes: 1\ntimestamp_field: \"@timestamp\"\ntimestamp_type: \"iso\"\nuse_strftime_index: false\nalert_text_type: alert_text_only\nalert_text: |\n  \ud83d\udea8\u300cprd-service\u544a\u8b66\u4fe1\u606f\u300d\n  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  \u65f6\u95f4: {0}\n  \u7ea7\u522b: \u9ad8\n  \u670d\u52a1\u540d\u79f0: {1}\n  \u7d22\u5f15\u540d\u79f0: {2}\n  \u91c7\u96c6\u8def\u5f84: {3}\n  \u89e6\u53d1\u6b21\u6570: {4}\n  \u65e5\u5fd7\u4fe1\u606f: {5}\n  \u8be6\u60c5\u8bf7\u767b\u5f55\u300ckibana\u300d\u67e5\u770b: http:\/\/10.10.10.171:5000\n  \u6709\u7591\u60d1\u8bf7&#91;\u8054\u7cfb\u8fd0\u7ef4\u540c\u5b66]\nalert_text_args:\n  - \"@timestamp\"\n  - \"fields.source\"\n  - \"_index\"\n  - \"log.file.path\"\n  - \"num_hits\"\n  - \"message\"\nfilter:\n  - query:\n      query_string:\n        query: \"message: ERROR\"\nalert:\n  - \"elastalert.dingtalk_alert.DingTalkAlerter\"\ndingtalk_webhook: \"https:\/\/oapi.dingtalk.com\/robot\/send?access_token=***\"\ndingtalk_msgtype: \"text\"<\/code><\/pre>\n\n\n\n<p>2\u3001\u53bb\u9664\u4e0d\u5fc5\u8981\u7684\u65e5\u5fd7<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>name: \"prd-service-gedai\"\ntype: \"frequency\"\nindex: \"prd-service-gedai*\"\nis_enabled: true\nnum_events: 1\ntimeframe:\n  minutes: 1\nrealert:\n  minutes: 1\ntimestamp_field: \"@timestamp\"\ntimestamp_type: \"iso\"\nuse_strftime_index: false\nalert_text_type: alert_text_only\nalert_text: |\n  \ud83d\udea8\u300c\u4e2a\u8d37\u544a\u8b66\u4fe1\u606f\u300d\n  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  \u65f6\u95f4: {0}\n  \u7ea7\u522b: \u9ad8\n  \u670d\u52a1\u540d\u79f0: {1}\n  \u7d22\u5f15\u540d\u79f0: {2}\n  \u91c7\u96c6\u8def\u5f84: {3}\n  \u65e5\u5fd7\u4fe1\u606f: {4}\n  \u8be6\u60c5\u8bf7\u767b\u5f55\u300ckibana\u300d\u67e5\u770b: http:\/\/10.10.10.171:5000\n  \u6709\u7591\u60d1\u8bf7&#91;\u8054\u7cfb\u8fd0\u7ef4\u540c\u5b66]\nalert_text_args:\n  - \"@timestamp\"\n  - \"fields.source\"\n  - \"_index\"\n  - \"log.file.path\"\n  - \"message\"\nfilter:\n  - query:\n      query_string:\n        query: \"(message: ERROR* OR message: *Exception*) AND NOT message: *MethodArgumentNotValidException* AND NOT message: *serviceExceptionHandler* AND NOT message: *DEBUG*\"\nalert:\n  - \"elastalert.dingtalk_alert.DingTalkAlerter\"\ndingtalk_webhook: \"https:\/\/oapi.dingtalk.com\/robot\/send?access_token=***\"\ndingtalk_msgtype: \"text\"<\/code><\/pre>\n\n\n\n<p>3\u3001web\u524d\u7aefrules<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>name: \"prd-web-***\"  # \u89c4\u5219\u7684\u540d\u79f0\uff0c\u7528\u4e8e\u8bc6\u522b\u548c\u8bb0\u5f55\ntype: \"frequency\"  # \u89c4\u5219\u7c7b\u578b\uff0c\u8fd9\u91cc\u662f \"frequency\"\uff0c\u8868\u793a\u5728\u7ed9\u5b9a\u7684\u65f6\u95f4\u8303\u56f4\u5185\u5339\u914d\u5230\u7684\u4e8b\u4ef6\u6570\u91cf\u8fbe\u5230\u67d0\u4e2a\u9608\u503c\u65f6\u89e6\u53d1\u544a\u8b66\nindex: \"prd-web-*\"  # Elasticsearch \u7d22\u5f15\u7684\u540d\u79f0\u6a21\u5f0f\uff0c\u8868\u793a\u4ece\u54ea\u4e2a\u7d22\u5f15\u83b7\u53d6\u6570\u636e\nis_enabled: true  # \u8868\u793a\u89c4\u5219\u662f\u5426\u542f\u7528\nnum_events: 1  # \u5728\u6307\u5b9a\u7684\u65f6\u95f4\u8303\u56f4\u5185\u9700\u8981\u5339\u914d\u7684\u4e8b\u4ef6\u6570\u91cf\uff0c\u4ee5\u89e6\u53d1\u544a\u8b66\ntimeframe:  # \u7528\u4e8e\u8ba1\u7b97\u4e8b\u4ef6\u9891\u7387\u7684\u65f6\u95f4\u8303\u56f4\n  minutes: 1  \nrealert:  # # \u5728\u89e6\u53d1\u544a\u8b66\u540e\uff0c\u591a\u957f\u65f6\u95f4\u5185\u4e0d\u518d\u89e6\u53d1\u65b0\u7684\u544a\u8b66\n  minutes: 1\ntimestamp_field: \"@timestamp\"   # \u5728\u89e6\u53d1\u544a\u8b66\u540e\uff0c\u591a\u957f\u65f6\u95f4\u5185\u4e0d\u518d\u89e6\u53d1\u65b0\u7684\u544a\u8b66\ntimestamp_type: \"iso\"  # \u4e8b\u4ef6\u65f6\u95f4\u6233\u5b57\u6bb5\u7684\u683c\u5f0f\u7c7b\u578b\nuse_strftime_index: false  # \u662f\u5426\u4f7f\u7528strftime\u683c\u5f0f\u52a8\u6001\u6784\u5efa\u7d22\u5f15\u540d\u79f0\nalert_text_type: alert_text_only  # \u544a\u8b66\u6587\u672c\u7684\u683c\u5f0f\u7c7b\u578b\nalert_text: |  # \u544a\u8b66\u6587\u672c\u6a21\u677f\uff0c\u5176\u4e2d\u7684\u5360\u4f4d\u7b26\u5c06\u88ab\u5b9e\u9645\u503c\u66ff\u6362\n  \ud83d\udea8\u300cprd-sweb\u544a\u8b66\u4fe1\u606f\u300d\n  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  \u65f6\u95f4: {0}\n  \u7ea7\u522b: \u9ad8\n  \u670d\u52a1\u540d\u79f0: {1}\n  \u7d22\u5f15\u540d\u79f0: {2}\n  \u91c7\u96c6\u8def\u5f84: {3}\n  \u89e6\u53d1\u6b21\u6570: {4}\n  \u8bf7\u6c42IP: {5}\n  \u8bf7\u6c42\u72b6\u6001: {6}\n  \u8bf7\u6c42URL: {7}\n  \u65e5\u5fd7\u4fe1\u606f: {8}\n  \u8be6\u60c5\u8bf7\u767b\u5f55\u300ckibana\u300d\u67e5\u770b: http:\/\/10.10.10.171:5000\n  \u6709\u7591\u60d1\u8bf7&#91;\u8054\u7cfb\u8fd0\u7ef4\u540c\u5b66]\nalert_text_args:  # \u7528\u4e8e\u66ff\u6362\u544a\u8b66\u6587\u672c\u6a21\u677f\u4e2d\u5360\u4f4d\u7b26\u7684\u5b57\u6bb5\u5217\u8868 (\u53bbkibana\u627e\u8be6\u7ec6\u4fe1\u606f)\n  - \"@timestamp\"\n  - \"fields.source\"\n  - \"_index\"\n  - \"log.file.path\"\n  - \"num_hits\"\n  - \"nginx.real_ip\"\n  - \"nginx.status\"\n  - \"nginx.url\"\n  - \"message\"\nfilter:  # \u67e5\u8be2\u548c\u7b5b\u9009\u5339\u914d\u7684\u4e8b\u4ef6\n  - query:\n      query_string:\n        query: \"nginx.status: &#91;400 TO 499] OR nginx.status: &#91;500 TO 599]\"\nalert:  # \u89c4\u5b9a\u544a\u8b66\u7c7b\u578b\u548c\u5904\u7406\u5668\uff0c\u8fd9\u91cc\u4f7f\u7528\u4e86\u4e00\u4e2a\u9489\u9489\u673a\u5668\u4eba\n  - \"elastalert.dingtalk_alert.DingTalkAlerter\"\ndingtalk_webhook: \"https:\/\/oapi.dingtalk.com\/robot\/send?access_token=***\"  # \u9489\u9489\u673a\u5668\u4eba\u7684 webhook URL\ndingtalk_msgtype: \"text\"  #  \u9489\u9489\u673a\u5668\u4eba\u53d1\u9001\u7684\u6d88\u606f\u7c7b\u578b<\/code><\/pre>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u524d\u8a00 \u73b0\u5728\u516c\u53f8\u7528\u7684\u662fELK\u65e5\u5fd7\u67b6\u6784\u505a\u65e5\u5fd7\u6536\u96c6\u548c\u5c55\u793a\u5206\u6790\uff0c\u6240\u4ee5\u76f8\u5bf9\u4e00\u4e9b\u65e5\u5fd7\u8fdb\u884c\u5173\u952e\u5b57\u8fdb\u884c\u544a\u8b66\uff0c\u6bd4\u5982MQTT\u3001Ng [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[82,80,73],"tags":[83,81],"_links":{"self":[{"href":"https:\/\/ext4.cn\/index.php?rest_route=\/wp\/v2\/posts\/1064"}],"collection":[{"href":"https:\/\/ext4.cn\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ext4.cn\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ext4.cn\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ext4.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1064"}],"version-history":[{"count":20,"href":"https:\/\/ext4.cn\/index.php?rest_route=\/wp\/v2\/posts\/1064\/revisions"}],"predecessor-version":[{"id":1458,"href":"https:\/\/ext4.cn\/index.php?rest_route=\/wp\/v2\/posts\/1064\/revisions\/1458"}],"wp:attachment":[{"href":"https:\/\/ext4.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1064"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ext4.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1064"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ext4.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1064"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}