安装elast alert的并不像安装文档写的那么easy，虽然如此下面这个博客还是可以推荐下：
http://blog.csdn.net/gamer_gyt/article/details/52917116
官网：http://elastalert.readthedocs.io/en/latest/elastalert.html#overview
1）解压安装:
解压后有一个config.yaml.example文件，将这个文件另存一份并命名为config.yaml。
配置该文件：
# This is the folder that contains the rule yaml files # Any .yaml file will be loaded as a rule rules_folder: example_rules # How often ElastAlert will query Elasticsearch # The unit can be anything from weeks to seconds run_every: minutes: 1 # ElastAlert will buffer results from the most recent # period of time, in case some log sources are not in real time buffer_time: minutes: 3 # The Elasticsearch hostname for metadata writeback # Note that every rule can have its own Elasticsearch host es_host: localhost # The Elasticsearch port es_port: 9200 # The AWS region to use. Set this when using AWS-managed elasticsearch #aws_region: us-east-1 # The AWS profile to use. Use this if you are using an aws-cli profile. # See http://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html # for details #profile: test # Optional URL prefix for Elasticsearch #es_url_prefix: elasticsearch # Connect with TLS to Elasticsearch #use_ssl: True # Verify TLS certificates #verify_certs: True # GET request with body is the default option for Elasticsearch. # If it fails for some reason, you can pass 'GET', 'POST' or 'source'. # See http://elasticsearch-py.readthedocs.io/en/master/connection.html?highlight=send_get_body_as#transport # for details #es_send_get_body_as: GET # Option basic-auth username and password for Elasticsearch #es_username: someusername #es_password: somepassword # The index on es_host which is used for metadata storage # This can be a unmapped index, but it is recommended that you run # elastalert-create-index to set a mapping writeback_index: elastalert_status # If an alert fails for some reason, ElastAlert will retry # sending the alert until this time period has elapsed alert_time_limit: days: 2
在elasticsearch中创建索引:
elastalert-create-index
创建Rule：
在example_rules下面，修改example_frequency.yaml文件：
# Alert when the rate of events exceeds a threshold
# (Optional)
# Elasticsearch host
# es_host: elasticsearch.example.com
# (Optional)
# Elasticsearch port
# es_port: 14900
# (OptionaL) Connect with SSL to Elasticsearch
#use_ssl: True
# (Optional) basic-auth username and password for Elasticsearch
#es_username: someusername
#es_password: somepassword
# (Required)
# Rule name, must be unique
name: Example frequency rule
# (Required)
# Type of alert.
# the frequency rule type alerts when num_events events occur with timeframe time
type: frequency
# (Required)
# Index to search, wildcard supported
index: cloud_platform-*
# (Required, frequency specific)
# Alert when this many documents matching the query occur within a timeframe
num_events: 3
# (Required, frequency specific)
# num_events must occur within this amount of time to trigger an alert
timeframe:
hours: 1
# (Required)
# A list of Elasticsearch filters used for find events
# These filters are joined with AND and nested in a filtered query
# For more info: http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl.html
filter:
- term:
_type: cloud_platform
# (Required)
# The alert is use when a match is found
alert:
- "email"
# (required, email specific)
# a list of email addresses to send alerts to
email:
- [email protected]
email_from_field: zhuoyp001
email_add_domain: "@xxxx.com"
from_addr: [email protected]
smtp_host: xxxx
smtp_port: 25
smtp_auth_file: smtp_auth_file.yaml
这里主要配置了alert的方式是email。
最后一行指定用户名密码的文件smtp_auth_file.yaml：
user: "[email protected]" password: "xxxx"
这样最简单的一个配置就完成了，当type: cloud_platform出现次数为3次后，就发告警邮件给[email protected]。
2）启动：
python -m elastalert.elastalert --verbose --rule example_rules/example_frequency.yaml
正常情况下就启动了，我往logstash里面灌了几条日志，注意时间，eslast alert只去查询当前时间前2分钟内的索引，自己灌入的日志要改时间，让@timestamp满足查询的时间范围。
INFO:elastalert:Ran Example frequency rule from 2017-08-09 08:48 CST to 2017-08-09 08:50 CST: 7 query hits (0 already seen), 2 matches, 1 alerts sent INFO:elastalert:Sleeping for 57.479314 seconds
问题&经验：
alert_time 索引不存在
之前启动的时候，一直报错，说需要排序的字段alert_time不存在。报错在elastalert/elastalert.py文件中。推测原因是因为之前我一直没有触发sent alert这个事件，因此alert_time没有写入索引。于是我把下面几行都注释掉了：
line 1386：sort = {'sort': {'alert_time': {'order': 'asc'}}}
line 1391：query.update(sort)
line1503：query['sort'] = {'alert_time': {'order': 'desc'}}
line1639：sort = {'sort': {'until': {'order': 'desc'}}}
line1644：query.update(sort)
再次启动就没有报错了。
最后我触发了发邮件功能后，再次将这些注释掉的行打开，也没有报错可以正常运行。
