使用elastalert的问题

• 使用通配符index的时候，需把use_strftime_index 设为true
  use_strftime_index： true
• index应该修改为如下格式
  index: logstash-vpn-%Y.%m.%d

以下是官方参考文档

index

index: The name of the index that will be searched. Wildcards can be used here, such as: index: my-index-* which will match my-index-2014-10-05. You can also use a format string containing %Y for year, %m for month, and %d for day. To use this, you must also set use_strftime_index to true. (Required, string, no default)

use_strftime_index

use_strftime_index : If this is true, ElastAlert will format the index using datetime.strftime for each query. See

https://docs.python.org/2/library/datetime.html#strftime-strptime-behavior

for more details. If a query spans multiple days, the formatted indexes will be concatenated with commas. This is useful as narrowing the number of indexes searched, compared to using a wildcard, may be significantly faster. For example, if

index is logstash-%Y.%m.%d , the query url will be similar to

elasticsearch.example.com/logstash-2015.02.03/...

or elasticsearch.example.com/logstash-2015.02.03,logstash-2015.02.04/... .