cd example_rules

vim example_frequency.yaml

es_host: elk01

es_host: elk02

es_host: elk03

es_port: 9200

 

name: Example frequency rule

type: frequency

index: eas-172.25.11.112-server1-apusic.log.0-*

num_events: 1

 

timeframe:

minutes: 1 #出现的时间段

 

filter: #规则

- query:

query_string:

query: "field: value"

 

filter:

- query_string:

    query: "message: 测试一下下"

 

######配置报警信息##########

alert_text: "jira服务出现问题"

#alert_text_type: alert_text_only

include: ["type", "ua", "log_time"] ###允许字段

#alert_text_type: exclude_fields

exclude: ["@timestamp", "_id", "_index", "_type"] ###排除字段

#attach_related: true

#top_count_keys: ["client_ip", "status"]

 

#############配置友好别名######

alert_text_type: alert_text_only （exclude_fields ##这个参数会显示默认报警注释）

alert_text: |

jira服务出现问题

主机: {}

请求URL: {}

HTTP状态码: {}

远程IP地址: {}

日志时间戳: {}

总查询次数: {}

总异常次数: {}

原始日志信息: {}

alert_text_args:

- client_ip

- ua

- status

- host

- log_time

- num_hits

- num_matches

- source

 

########配置邮件报警###############

smtp_host: cm-inv.com #SMTP协议的邮件服务器相关配置

smtp_port: 25

 

#邮箱用户认证

smtp_auth_file: /home/elastalert/elastalert/example_rules/smtp_auth_file.yaml

#回复给哪个邮箱

email_reply_to: zhaishaominceshi@qq.com

#从哪个邮箱发送

from_addr: zhaishaominceshi@qq.com

 

alert:

- "email"

 

#接收报警的邮箱

- "11780911006@qq.com"

 

 

测试：

cd /opt/soft/elastalert/

python -m elastalert.elastalert --verbose --rule example_frequency.yaml

 

curl -X POST "http://172.26.11.79:9200/eas-172.25.11.112-server1-apusic.log.0-2017-07-25/test" -d ‘{ "@timestamp": "2017-07-25T11:43:30.000Z", "field": "value" }‘

 

#############以下是服务的配置#################################

mkdir /etc/elastalert

cd /etc/elastalert

复制配置文件

cp /opt/soft/elastalert/config.yaml ./

 

mkdir rules

复制规则文件

cp /opt/soft/elastalert/example_rules/example_frequency.yaml rules/

 

####修改配置文件 

修改 config.yaml 中

vim config.yaml

rules_folder: /etc/elastalert/rules

 

##################配置微信报警#################################

cd /opt/soft/elastalert

wget -P elastalert_modules/ https://raw.githubusercontent.com/anjia0532/elastalert-wechat-plugin/master/wechat_qiye_alert.py

touch elastalert_modules/__init__.py

cd example_rules/

vim example_frequency.yaml

####配置微信报警######

alert:

- "elastalert_modules.wechat_qiye_alert.WeChatAlerter"

 

#设置微信企业号的appid

corp_id: wxc27a71b135ab

#设置微信企业号的Secret

secret: MQp6r1DYJ0wPCF-xRPYVvDWBJddgAnFBzHwJyVM

#后台登陆后【应用中心】->【选择应用】->【应用id】

##设置微信企业号应用id

agent_id: 100

##部门id

party_id: 1

##用户微信号

user_id: 10515480

## 标签id

tag_id: admin

 

 

######测试#######

python -m elastalert.elastalert

curl -X POST ‘http://172.26.11.77:9200/eas-172.25.11.112-server1-apusic.log.0-‘$(date +%Y.%m.%d)‘/test‘ -d ‘{"@timestamp": "‘$(date +%Y-%m-%d‘T‘%T%z)‘","field": "value"}‘

 

######报错#######

ERROR:root:Error while running alert WeChatAlerter: send message has error: ("bad handshake: Error([(‘SSL routines‘, ‘SSL3_GET_SERVER_CERTIFICATE‘, ‘certificate verify failed‘)],)",)

 

pip uninstall -y certifi && sudo pip install certifi==2015.04.28

pip install certifi==2015.04.28

 

 

 

启动服务

python -m elastalert.elastalert &

python -m elastalert.elastalert --config ./config.yaml

 python elastalert/elastalert.py