对Elastalert的学习与实践

本篇仅记录了在使用中接触到的，会在今后使用中不断更新。

Elastalert

ElastAlert是Yelp公司开源的一套用Python写的报警框架。

安装

pip install elastalert

命令

elastalert-create-index命令用来创建ES索引的，默认为elastalert_status

elastalert-test-rule测试自定义配置中的rule设置

elastalert-rule-from-kibana从Kibana3中直接导出Filters

Example Config

# 规则文件目录，建议使用全路径
rules_folder: example_rules

# 用来设置定时向ES发请求
run_every:
  minutes: 5

# 用来设置请求里时间字段的范围
buffer_time:
  minutes: 15

# Elasticsearch host
es_host: elasticsearch.example.com

# The Elasticsearch port
es_port: 9200

# Optional URL prefix for Elasticsearch
#es_url_prefix: elasticsearch

# Connect with TLS to Elasticsearch
#use_ssl: True

# Verify TLS certificates
#verify_certs: True

# GET request with body is the default option for Elasticsearch.
# If it fails for some reason, you can pass 'GET', 'POST' or 'source'.
# See http://elasticsearch-py.readthedocs.io/en/master/connection.html?highlight=send_get_body_as#transport
# for details
#es_send_get_body_as: GET

# Option basic-auth username and password for Elasticsearch
#es_username: someusername
#es_password: somepassword

# The index on es_host which is used for metadata storage
# This can be a unmapped index, but it is recommended that you run
# elastalert-create-index to set a mapping
writeback_index: elastalert_status

# If an alert fails for some reason, ElastAlert will retry
# sending the alert until this time period has elapsed
alert_time_limit:
  days: 2

# 当Alert需要Email时
# 以下使用QQSMTP服务
# smtp_auth_file为SMTP Email账号信息的配置文件路径（使用yaml，key为user和password），建议使用全路径
smtp_host: smtp.exmail.qq.com
smtp_port: 465
smtp_ssl: true
smtp_auth_file: ~/email_auth.yaml
from_addr: [email protected]

Example Rule

es_host: host
es_port: port
name: rule_name
type: frequency
use_strftime_index: true
index: project-%Y.%m.%d

# 指定事件数，进行Alert
num_events: 5
timeframe:
  minutes: 1

# 查询条件
filter:
- query:
    query_string:
      query: "ERROR"

# Alert使用Email
alert:
- "email"

# 通知多个Email
email:
- "[email protected]"
- "[email protected]"